OAuth Access Token Support

This release adds comprehensive OAuth access token support, enabling delegated authentication for third-party integrations and users who prefer OAuth over API keys.

Added

• ATTIO_ACCESS_TOKEN environment variable - Alternative to ATTIO_API_KEY for OAuth integrations
• Local OAuth helper script (npm run oauth:setup) - Interactive PKCE flow for obtaining tokens
• Token refresh command (npm run oauth:refresh) - Refresh expired tokens
• Cloudflare Worker OAuth template - Self-hostable OAuth broker at examples/cloudflare-oauth-worker/
• Comprehensive OAuth documentation - Guide at docs/guides/oauth-authentication.md
• Improved 401 error messages - OAuth-specific guidance for token expiration

Platform Support

Claude Desktop Usage

# Obtain tokens via local PKCE flow
npm run oauth:setup

{
  "mcpServers": {
    "attio": {
      "command": "npx",
      "args": ["-y", "attio-mcp"],
      "env": {
        "ATTIO_ACCESS_TOKEN": "your_oauth_access_token_here"
      }
    }
  }
}

ChatGPT Support

ChatGPT requires remote OAuth (no localhost callbacks). Two options:

1. Smithery (recommended) - Deploy via smithery.ai which handles OAuth automatically
2. Self-hosted Cloudflare Worker - Deploy the template at examples/cloudflare-oauth-worker/

The Cloudflare Worker provides the required endpoints:

• Remote callback handling
• Dynamic Client Registration (DCR)
• .well-known/oauth-protected-resource discovery
• Full OAuth 2.1 Resource Server compliance

Full Changelog

See CHANGELOG.md for complete details.