OAuth

HyperMemory is an OAuth 2.1 authorization server for its MCP endpoint. MCP clients that support OAuth — Claude, ChatGPT, Codex, Cursor, Claude Code and others — discover it automatically, register themselves, and send you to HyperMemory’s sign-in page. You never handle a key.

What you see

1. You add https://api.hypermemory.io/mcp to your client (or install a plugin).
2. The client opens HyperMemory’s sign-in page in your browser.
3. You sign in with email and password, Google or GitHub, and approve the connection.
4. The client receives tokens and refreshes them in the background.

For client developers

Item	Value
Issuer	https://api.hypermemory.io
Authorization server metadata	GET /.well-known/oauth-authorization-server
Protected resource metadata	GET /.well-known/oauth-protected-resource/mcp (resource: https://api.hypermemory.io/mcp)
Dynamic client registration	POST /register
Client ID metadata documents	Supported
Authorization	GET /authorize — authorization code flow with PKCE (S256) required
Token	POST /token — authorization_code and refresh_token grants
Client authentication	none (public clients), client_secret_post, client_secret_basic
Access token lifetime	1 hour
Refresh token	Expires after 180 days without use

An unauthenticated MCP request gets 401 with a WWW-Authenticate: Bearer resource_metadata="…" header pointing at the protected-resource metadata, which is how clients start the flow.

Dynamic client registration is rate limited per address. A client over the limit gets 429 with Retry-After.

Scopes

The server advertises memory:read, memory:write and memory:admin. They don’t narrow access today: a signed-in client acts as you on your default graph, with your plan and roles. See Permissions.

Revoke access

To disconnect a client, remove HyperMemory from it — or open Account → Integration in the dashboard, where connected apps are listed, and disconnect it there.