Skip to main content
Paste one URL into your client:
Use the API origin, not the web app origin. Self-hosting? Settings → Connected apps shows every snippet below with your own deployment’s URL in it.

​
Client setup

Once, in any terminal, for every project. Claude Code opens your browser to authorize.
Any other client implementing the MCP authorization specification registers itself and refreshes tokens through the discovery documents.

​
Names work anywhere IDs do

Pass a name to any tool that takes an ID.
Docket matches exact, then prefix, then substring, and accepts only an unambiguous hit. Send “Sam” with two Sams in the workspace and Docket returns an error listing both.

​
Getting a token

The client registers through DCR or a URL-form client ID, sends you to the consent screen, and exchanges the code with PKCE for a token bound to the /mcp resource URL. A token can never do more than you can. Full detail in Authentication.

​
The transport

POST sends messages, GET opens the stream, DELETE ends the session. Requests are stateless. initialize returns an Mcp-Session-Id anyway; send it back, open GET /mcp, and Docket sends:
  • notifications/resources/updated for anything you subscribed to
  • notifications/tools/list_changed when a grant change alters what you may call
  • notifications/message at whatever level you set via logging/setLevel
Delivery is best-effort and never replayed. Read the resource again when one arrives.

​
Athena as an MCP client

Athena can also call an external MCP server for a workspace. Go to Settings → Connections → MCP connectors, enter the server URL, choose Sign in and approve access, and finish the provider’s browser approval. Docket calls tools/list first and renames each tool <connector>__<tool>. Athena receives those tools, never a raw user token.
External tools do not bypass Docket’s approval policy. A tool’s declared annotations and the normal action policy still decide whether Athena may execute it or must ask you first.

​
Revoking access

Settings → Connected apps revokes one client at a time, deleting the consent and its access tokens. Access tokens expire after 15 minutes anyway, refresh tokens after 30 days.

​
Self-hosting

The OAuth server runs in every deploy and needs no MCP-specific configuration. Docket derives the issuer from the API URL, the resource from ${API_URL}/mcp, and the login page from ${WEB_URL}/sign-in. Registration, token exchange, introspection, revocation, the JWKS, and both discovery documents are public under an open credential-free CORS policy, per RFC 7591, 6749, 7662, 7009, 8414, and 9728.

​
Reference

Tools, resources, and prompts

All 25 tools, the docket:// resource scheme, and the bootstrap prompts.