# Authenticating with Mercury

Mercury exposes a hosted, read-only Model Context Protocol server at
https://mcp.mercury.com/mcp. It uses OAuth 2.0 Authorization Code with PKCE and
supports Dynamic Client Registration.

## Discovery

- Protected resource metadata: https://mcp.mercury.com/.well-known/oauth-protected-resource
- Authorization server metadata: https://mcp.mercury.com/.well-known/oauth-authorization-server
- Client registration: https://mcp.mercury.com/register
- Authorization: https://mcp.mercury.com/authorize
- Token exchange: https://mcp.mercury.com/token

Request the read scope. Request offline_access only when the client needs a refresh token.
Native and command-line clients should use token_endpoint_auth_method=none and PKCE S256.

Complete connection instructions are at
https://docs.mercury.com/docs/connecting-mercury-mcp.

## Mercury API integrations

OAuth access to Mercury's banking API is a separate, approval-based integration program.
See https://docs.mercury.com/docs/integrations-with-oauth2. The hosted MCP registration
flow does not register a client for the banking API.