Authentication and permissions

AdVentur.ai’s MCP server uses OAuth 2.1, the same standard as “Sign in with Google”. You never paste a password or an API key into your assistant: it sends you to AdVentur.ai to sign in, and you decide what it may do.

Permissions

Each connection is for one workspace and a set of scopes you choose on the consent page. Every tool needs exactly one scope. Read access is always granted; the rest are optional, so you can, for example, let an assistant draft but never schedule.

mcp:readView your workspacealways granted

Read your home brief, strategy, inspiration, posts, analytics and connected social accounts.

27 tools: find_brand_kit_on_website, get_brand_kit, get_engagement_settings, get_home_summary, get_launch_kit, get_newsjacking_settings, get_niche_news, get_performance_summary, get_platform_algorithm_hints, get_strategy, get_trending_topics, get_usage, get_x_account_analytics, get_x_automation_rules, list_dm_conversations, list_inspiration_opportunities, list_launch_kits, list_media, list_posts, list_reply_inbox, list_social_accounts, list_thoughts, list_top_posts, list_viral_post_formats, list_visual_options, list_x_automation_runs, suggest_slots

posts:writeCreate draftsoptional

Add draft posts to your Review queue, draft replies in your reply inbox, create branded images and carousels, and run research that uses your usage credits, such as finding trending topics and reading posts on X. Drafts wait for your approval.

32 tools: add_dm_conversation, complete_media_upload, create_app_screenshot, create_branded_image, create_carousel, create_draft_post, create_launch_kit, create_media_upload, create_x_thread, draft_dm, draft_post_from_thought, draft_reply, find_trending_topics, get_x_post, get_x_thread, import_media_from_url, refresh_reply_inbox, reject_post_group, rewrite_post, run_x_automation, save_thought, suggest_reddit_listening, suggest_x_accounts, update_dm_conversation, update_engagement_settings, update_launch_step, update_newsjacking_settings, update_post, update_post_group, update_reply_draft, update_thought, update_x_automation_rules

posts:scheduleApprove and schedule postsoptional

Approve drafts and schedule them to publish on your connected social accounts.

2 tools: approve_post_group, schedule_post_group

posts:publishPublish posts nowoptional

Publish a post you've approved to your connected social accounts straight away instead of waiting for its slot, and send X replies you've approved.

2 tools: post_now, send_reply

posts:deleteDelete postsoptionaldestructive

Delete your own posts from X and take posts off your schedule. Deleting a published post can't be undone.

1 tool: delete_x_post

brand:writeUpdate your brand kitoptional

Set your brand colours, fonts, tagline and logo, which your branded images and carousels use.

1 tool: update_brand_kit

Deleting is opt-in

posts:delete is the only scope whose tools remove anything, and its tools are marked destructive so clients ask before running them. Deleting a live X post can’t be undone.

Whatever the scopes, assistants follow your workspace’s approval rules: post_now refuses a post that isn’t approved, and nothing an assistant drafts skips the Review queue.

Changing or revoking access

• See and revoke connections in the app under AI assistants or Settings, in the Connected apps list. Revoking ends the connection straight away, including tokens already issued.
• Change permissions by disconnecting and connecting again; the consent page lets you choose afresh.
• Disconnecting in your client (removing the connector) stops it using AdVentur.ai, and its refresh token expires on its own.

Tokens

	Lifetime	Notes
Authorization code	5 minutes	One use, bound to the PKCE challenge.
Access token	1 hour	Sent as Authorization: Bearer … on every MCP request.
Refresh token	30 days	Rotated on every use: each refresh returns a new one and the old one stops working.

Tokens are random strings stored only as hashes, so a database copy can’t be replayed. Revoking a refresh token at the revocation endpoint ends the whole connection.

The OAuth flow

You only need this if you’re building your own client; Claude, ChatGPT, Cursor and the rest do it for you.

1. Discover. Call the MCP endpoint without a token. The 401 response carries WWW-Authenticate: Bearer … resource_metadata="https://api.adventur.ai/.well-known/oauth-protected-resource/mcp". That document names the authorization server, https://api.adventur.ai, whose metadata is at https://api.adventur.ai/.well-known/oauth-authorization-server.
2. Register. POST https://api.adventur.ai/oauth/register with your client_name, redirect_uris and token_endpoint_auth_method (none for public clients, or client_secret_post / client_secret_basic).
3. Authorize. Send the user to https://api.adventur.ai/oauth/authorize with response_type=code, your client_id, redirect_uri, the scope you want (space-separated; leave it out to ask for every scope), a state, and PKCE: code_challenge with code_challenge_method=S256 is required. Add resource=https://api.adventur.ai/mcp to bind the token to the MCP server.
4. Exchange. POST https://api.adventur.ai/oauth/token with grant_type=authorization_code, the code, redirect_uri and code_verifier. You get access_token, refresh_token, expires_in and the granted scope.
5. Refresh. POST https://api.adventur.ai/oauth/token with grant_type=refresh_token. Store the new refresh token you get back.
6. Revoke. POST https://api.adventur.ai/oauth/revoke with token when the user disconnects.

Discover the authorization server

curl -s https://api.adventur.ai/.well-known/oauth-protected-resource/mcp
curl -s https://api.adventur.ai/.well-known/oauth-authorization-server

The user may grant fewer scopes than you asked for. Read the scope in the token response, and expect tools outside it to be missing from tools/list.