Authentication
How the connector signs in, how long tokens last, and how to revoke access.
The connector uses OAuth 2.1, with Huff as its own authorization server. Every action runs as the person who signed in, and stays inside the organization they approved. Huff has no shared service account for the connector and no API keys for it.
What a connection is
A connection is one consent: one person, in one organization, for one app.
- Same access as the app. Tools go through the same service layer as the Huff app. A person's role, teams, and markets apply to every tool call.
- One organization. If you belong to more than one, the connection stays in the one you approved. Huff never falls back to another.
- Leaving ends it. Once someone leaves the organization, calls fail immediately with a 403, and refreshing the token does not help.
- Huff staff cannot create one for you. Connecting is refused while Huff staff are viewing an account as a customer.
Sign-in flow
- Claude calls
POST https://api.huffintel.com/mcpwith no token and gets a 401 with aWWW-Authenticateheader pointing at the protected resource metadata. - That metadata names the issuer, and Claude reads the issuer's authorization server metadata.
- Claude registers itself as a client (RFC 7591 dynamic client registration).
- Claude sends you to the consent page with a PKCE S256 challenge. You sign in if needed, accept current terms if needed, and choose Allow.
- Claude exchanges the code for tokens and calls the server with the access token, refreshing it when it expires.
Endpoints
| Purpose | URL |
|---|---|
| MCP server (protected resource) | https://api.huffintel.com/mcp |
| Protected resource metadata | https://api.huffintel.com/.well-known/oauth-protected-resource/mcp |
| Issuer | https://app.huffintel.com |
| Authorization server metadata | https://app.huffintel.com/.well-known/oauth-authorization-server |
| Client registration | https://app.huffintel.com/api/oauth/register |
| Consent page | https://app.huffintel.com/oauth/authorize |
| Token | https://app.huffintel.com/api/oauth/token |
Scopes
There is one scope, mcp. It covers all 17 tools. Other requested scopes are ignored, not refused. There is no read-only scope today, so a connection can use both read and write tools. Limit writes through your Claude settings, which can require approval for each write.
Token lifetimes
| Credential | Lifetime | Use |
|---|---|---|
| Authorization code | 10 minutes | Single use |
| Access token | 1 hour | Sent as a bearer token on each call |
| Refresh token | 30 days from its last use | Single use. Each refresh returns a new one. |
If a connection is not used for 30 days, you sign in again.
How credentials are protected
- PKCE is required, S256 only.
- Redirect URIs must match exactly. A loopback
httpredirect may change its port, which is how Claude Code receives its code. - Tokens work only for the Huff MCP server, because each is bound to that resource (RFC 8707). They do not work on any other Huff API.
- Client secrets, codes, and tokens are stored as SHA-256 hashes. The plaintext exists only in the response that hands it out.
- Replaying a used code or refresh token revokes the whole connection, because a replay means the credential leaked.
Revoking access
Each person, from Huff (this is the one that ends access):
- Open the menu behind your avatar and go to Profile.
- Under Connected apps, find Claude and choose Disconnect.
This takes effect at once, and all of that connection's tokens stop working.
From Claude: removing the connector stops Claude from using it, but it does not end the connection on Huff's side, because Huff has no token revocation endpoint yet. To end access completely, disconnect in Huff as well.
As an admin: there is no organization-wide list of connected apps yet. Removing a person from your organization stops their connection immediately. To check on or remove a connection for someone who is staying, write to support.
Sign out everywhere on the Profile page ends browser sessions only. Connected apps stay connected.