Docs · authentication

Authentication

Every request to https://app.hiresteve.ai/api/agent/mcp carries a bearer token that belongs to one person in one organization. The setup flow on the overview page obtains it for you: your assistant opens a browser sign-in, you pick the organization, and the token lands in your client's configuration. Nothing here needs doing by hand.

( How the grant works )

• GrantOne person in one organization. The connection carries an org, never a single project.
• Access tokenBearer on every request. Lives one hour, then refresh.
• Refresh tokenLives 60 days and rotates on every use. A reused old token revokes the whole connection as a precaution.
• StorageTokens are held by your assistant's client config. The server stores only hashes; nothing in our database is a usable credential.
• RevocationRevoke any connection from the Steve app; the next request fails with grant_revoked.

( Auth errors )

Auth failures come back as a typed code so your assistant can recover without guessing. All of them resolve by refreshing or reconnecting:

• missing_token / invalid_tokenNo bearer, or one the server does not recognize. Reconnect.
• token_expiredAccess tokens live one hour. Refresh with the stored refresh token.
• refresh_expiredThe 60-day session lapsed. Normal after a long gap; reconnect.
• refresh_reusedOne refresh token was used twice, so the connection was revoked as a precaution. Reconnect.
• grant_revokedThe connection was revoked from the app or by an admin.
• org_membership_lostThe user is no longer a member of the connected organization.

( Scope and safety )

• ›The token authorizes exactly what the signed-in person can see in their organization, nothing more. Data is organization-scoped on every method.
• ›Tokens go in the Authorization header only. A token in a query string ends up in logs, so the server refuses that form.
• ›Leaving the organization revokes access: membership is re-checked when tokens refresh.