Authentication

Hoist Assets has two authentication surfaces. REST API and CLI calls use bearer tokens. MCP clients obtain bearer tokens through OAuth consent after a signed-in human approves access.

REST API and CLI bearer tokens

Every API request except GET /v1/_health needs a bearer token.

Authorization header

Authorization: Bearer $HOIST_TOKEN

Credential handling.Treat bearer tokens like passwords. Do not place them in browser code, public repos, screenshots, prompts, or analytics payloads.

The CLI can use the same token with --token or the HOIST_TOKEN environment variable. There is no separate CLI key flow.

MCP OAuth consent

MCP clients use OAuth consent. A human approves the scopes the AI client can use, and Hoist stores the approval, billing checks, and audit events server-side.

Use this issuer and route set:

Route	Purpose
https://mcp.assets.hoistai.com/.well-known/oauth-authorization-server	OAuth metadata
https://mcp.assets.hoistai.com/oauth/register	Dynamic client registration
https://mcp.assets.hoistai.com/oauth/authorize	Human approval
https://mcp.assets.hoistai.com/oauth/token	Token exchange
https://mcp.assets.hoistai.com/oauth/revoke	Disconnect or revoke
https://mcp.assets.hoistai.com/mcp	Protected MCP endpoint

Scopes

Tokens and approvals are limited to the scopes granted at issue time.

• ppsr:search.org
• ppsr:search.serial
• abn:lookup
• gst:status
• assets:receipts
• mcp:account.receipts

Human dashboard sign-in

Human account pages use browser sessions. API, CLI, and MCP calls use bearer tokens with explicit scopes, so keep machine-client tokens separate from browser sign-in state.