OAuth (sign in with FalconryScale)

OAuth is the main way to connect an AI assistant to FalconryScale. Instead of copying a secret into a tool, you sign in to FalconryScale and approve what the assistant may do. An API key is the backup for tools that can't sign in.

What happens when you connectCopy Anchor Link

1. You add the server URL (https://app.falconryscale.com/mcp) to your assistant. Per-client steps are on the MCP server page.
2. The assistant finds out where to sign in. It reads the server's public metadata at /.well-known/oauth-protected-resource/mcp, which points it to FalconryScale's sign-in service.
3. Your browser opens the FalconryScale sign-in. If you're already signed in, this step is skipped. New to FalconryScale? Create an account there and you can finish your profile later.
4. You see an approval screen. It names the assistant and lists the access it asks for. Choose Allow or Deny.
5. The assistant gets an access token and sends it with every request, the same way an API key is sent. You never see or copy it.

FalconryScale uses Clerk, the same identity service behind FalconryScale sign-in, as its OAuth authorization server. Assistants that support the MCP authorization spec register themselves automatically, so there's nothing to set up on your side.

When you're done, the connected page summarizes what an assistant can do with your account.

What you approveCopy Anchor Link

An OAuth token carries the same two scopes as an API key:

• falconry:read: view raptors, weights, activity, health records and alerts.
• falconry:write: also log weights, feedings and activity. Implies read.

The approval screen shows exactly what the assistant asked for. An assistant that doesn't ask for anything specific gets read-only access. To let an assistant log entries for you, it has to ask for write access and you have to approve it. If yours only ever asks for read access, use a Read and write API key with it instead.

A token with neither scope gets no access at all: every request comes back 403 forbidden.

See and disconnect connected assistantsCopy Anchor Link

Open Settings › Developer › Connected apps in the web app. It lists each assistant that has used your account through sign-in:

• its name, and its access (Read or Read and write)
• when it was first and last used

An assistant shows up after its first request to FalconryScale, not the moment you approve it.

Choose Disconnect to stop FalconryScale accepting that assistant for your account immediately, including any tokens it already holds. Then also remove the FalconryScale connector inside the assistant, so it stops trying. Allow again lifts a disconnect; it can take up to a minute to apply. To connect from scratch instead, add the connector again and approve it.

Tokens and expiryCopy Anchor Link

• Access tokens are short-lived. Your assistant refreshes them in the background, so you only sign in again if you disconnect it or remove the connector.
• Tokens are only accepted on https://app.falconryscale.com/mcp and /api/v1, and only as an Authorization: Bearer header. Session cookies are never accepted there.
• FalconryScale may limit which issued tokens it accepts, for example to ones issued for FalconryScale itself. This never changes what you see or approve.

If an assistant can't sign inCopy Anchor Link

Not every MCP client implements sign-in yet. For one that doesn't, create an API key and send it as a bearer header, see Connect with an API key. A key works the same everywhere and you can revoke it under Settings › Developer › API keys.