PDFSight authentication and connector help

PDFSight uses OAuth 2.1-style authorization for remote MCP connectors. Clients should discover the configuration from the metadata endpoints below instead of hard-coding authorization endpoints.

Canonical identifiers

Authorization issuer: https://pdfsight.com

Protected MCP resource: https://pdfsight.com/mcp

Discovery

Supported MCP resource scopes

pdfsight.form.read
pdfsight.form.write

Request only the scopes your connector needs. pdfsight.form.read permits access to the authenticated user's temporary forms and generated PDFs; pdfsight.form.write permits PDF upload, analysis, and filling.

Identity and authorization-server scopes

email
offline_access
openid
profile

openid, profile, and email control identity claims. offline_access requests rotating refresh tokens; it is not an MCP resource permission.

Connector requirements

Use the authorization-code flow with PKCE using S256.
Send the exact MCP resource identifier as the OAuth resource parameter on authorization and token requests.
Register and validate exact redirect URIs. PDFSight does not accept wildcard redirect URIs.
Public clients authenticate with token_endpoint_auth_method=none; no client secret is issued to browser or desktop connectors.
Send access tokens only in the HTTP Authorization: Bearer header. Tokens are never accepted in artifact URL query strings.
Use rotating refresh tokens when requesting offline_access, and call the revocation endpoint when disconnecting.

User accounts

When self-service enrollment is enabled, a new user can create an account from the PDFSight sign-in page shown during connector authorization. PDFSight creates the account only after a one-time email code is verified, then resumes the same authorization request at consent. A preregistered “Continue with ChatGPT” identity option is shown only if OpenAI has provisioned PDFSight an OIDC client; PDFSight never links accounts from email equality alone.

This page contains public protocol metadata only. It never displays account credentials, authorization codes, access tokens, refresh tokens, passwords, or test-user data.

Support

For connector registration or authentication help, visit PDFSight Support or email [email protected]. Do not send credentials or document contents by email.