Connect once. Recover safely.

First connection

1. Request the endpoint without a token and follow the Bearer challenge’s resource_metadata URL only when it equals https://stele.monolythium.com/.well-known/oauth-protected-resource/mcp exactly. A client that starts from the resource identifier can construct that well-known URL directly.
2. Fetch that protected-resource metadata and require its resource value to equal https://stele.monolythium.com/mcp exactly. Require authorization_servers to contain exactly one value, and require that selected value to equal https://stele.monolythium.com exactly. Do not use the metadata if any check fails.
3. Discover that selected authorization server. Require its returned issuer to equal both that selected value and https://stele.monolythium.comexactly, and require code_challenge_methods_supported to advertise S256. Use only the endpoints from that validated document.
4. Allocate an ephemeral port and bind an HTTP listener only to a literal loopback IP,127.0.0.1 or [::1]. Start it before registration, then dynamically register that exact callback URI—including port and path—as a native public client. Stele issues no client secret. Do not send HTTP Basic client authentication. If registration fails, close the listener and stop.
5. Start Authorization Code flow with a fresh state value, PKCE verifier, and S256 challenge. Send https://stele.monolythium.com/mcp on both the authorization and token requests.
6. Open the authorization URL in the browser. The user signs in with their browser wallet, reviews the named client and scopes, and approves or denies the request. Use a bounded response timeout; on browser-launch failure, abandonment, or timeout, close the listener and stop.
7. Accept at most one callback on the registered loopback listener. As soon as the authorization response arrives, stop accepting new connections. Before parsing response parameters, require the scheme, loopback host, port, path, and any pre-registered query to match the callback exactly, then verify state. On denial, an OAuth error, or callback or state failure, close the listener and stop. For a valid code, close the listener before token exchange, then redeem the one-time code with the original verifier.

If Stele returns invalid_client

A cached public registration may be missing, expired, or revoked. Treat those cases identically and recover with one clean attempt:

1. Close any old callback listener. Discard the cached client registration and its tokens for this exact issuer, resource, and redirect URI.
2. Repeat protected-resource and authorization-server discovery, including every exact resource, issuer, and S256 validation above.
3. Allocate and start a new loopback listener, then dynamically register once with its exact callback URI.
4. Restart the complete browser authorization flow with a new state, verifier, and S256 challenge. Never reuse a state value, verifier, authorization code, or token.
5. If that fresh registration, browser authorization, callback validation, or token exchange fails or times out, close the listener, stop, and surface the error. The listener must already be closed before token exchange. Do not create a registration loop.