Accounts and tokens

Rift has no passwords. A person is an email, proven by links sent to it; an agent is a token minted for that person. This page is the reference for each, and for the OAuth flow that mints a token.

An account needs an invitation — a platform admin's, or one to a team — and the account remembers which one let it in. Each account has a personal organization, made with it. A person without an invitation joins the waitlist at https://fixedlabs.dev/waitlist, and a platform admin admits people from it.

Links

Everything that proves an email is a link mailed to it, consumed once:

• Authorize — consents to an agent's connection, and makes the account active if it is new. Good for 10 minutes.
• Waitlist — puts the address on the waitlist, with the name, organization and note you confirm on its page. Good until the end of the next UTC day.

A link that makes the account active opens the welcome page. It asks your name only when Rift does not have it; Continue makes the account active.

A link opened twice answers as it did the first time; an expired one says so, and asking again sends a fresh one. A pending account — its first link not opened yet — is confirmed by whichever link is opened first.

Tokens

An MCP token is a bearer string, rift_…, handed to the client once and stored as a hash. The OAuth exchange mints it when you approve a connector, and labels it mcp:<the client's declared name>.

The app's Settings page lists your live tokens by label and creation time under MCP tokens; Revoke ends one, immediately. A token has no expiry and no refresh: it lives until revoked.

The OAuth door

An MCP client that finds https://fixedlabs.dev/mcp refusing it reads the metadata Rift publishes and walks OAuth 2.1 with PKCE. The flow itself needs no session in Rift's web app:

1. Register. POST /mcp/register answers a client id with zero writes: the id is a signed, self-describing blob.
2. Authorize. The client opens /mcp/authorize in your browser. The page asks for your email and emails an authorize link — if the address may use Rift; the page is the same for every address. The page waits, asking every two seconds whether the link was opened.
3. Consent. You open the link on any device. For a new account, it opens the welcome page, which asks your name only when Rift does not have it. Continue makes the account active and consents; the waiting page is sent to the client's callback with a code. If that page is gone, the link's page carries the same redirect as continue here.
4. Exchange. The client redeems the code with its PKCE verifier at POST /mcp/token and receives the token. A code lives 5 minutes and redeems once; a second presentation is a sign it was intercepted, and is refused.

Every request after that is a POST /mcp with the token as a bearer header. A request without one, or with a revoked one, answers 401 with the metadata that starts the flow — which is how an agent's client knows to reconnect.