Authentication & registration

• The client fetches the discovery documents (/.well-known/oauth-protected-resource → /.well-known/oauth-authorization-server), then registers itself at the Registration endpoint via Dynamic Client Registration — no manual client_id setup.
• It opens the Authorization URL; you sign in to JetHost (reusing your existing session and 2FA) and approve the requested scopes on a consent screen.
• The client exchanges the authorization code (with its PKCE verifier) at the Token endpoint for a short-lived access token (15 min) and a rolling refresh token (30 days; refresh tokens minted by a Advanced Token Manager credential are instead capped at the credential's expiry).
• Every MCP call sends Authorization: Bearer <access_token>. The server verifies the token and enforces scope + ownership on each tool (see Token types).
• You can review and revoke tokens anytime from Manage tokens.

• OAuth access tokens (this flow) are RS256 JWTs: the server verifies the signature offline against the JWKS, then checks the grant live so revocation applies immediately.
• API paste tokens (jh_pat_…, 50 characters) exist only for Advanced Token Manager credentials. They are opaque — nothing to verify offline — so the server introspects each one against the authorization server on every request and fails closed: if the check cannot complete, the call is denied.

The catalog tools (list_hosting_plans, get_hosting_plan, check_domain_availability, suggest_domains) return public catalog data with either token type — the token never filters which entries return; it only personalizes prices to your account, such as partner pricing.