Memo OAuth — DCR plus PKCE to First MCP Call

Memo OAuth — DCR plus PKCE to First MCP Call A sequence diagram generated by Archify. POST /api/mcp, no bearer 401 + resource metadata discovery + register (DCR) 201 client_id mc_... authorize + consent UI 303 code mac_... token + PKCE verifier issue pair ma/mr 200 tokens, 1h Bearer ma_... works refresh grant later rotate: old single-use Discovery + DCR Authorize + token Use + rotate Client · claude.ai · Sequence participant Client claude.ai Memo AS · oauth + mcp · Sequence participant Memo AS oauth + mcp Clerk · owner sign-in · Sequence participant Clerk owner sign-in Token store · single-use rows · Sequence participant Token store single-use rows Legend main request return security async trace message