---
title: Wapiworld authentication
description: Authentication walkthrough for the Wapiworld REST API and OAuth-protected MCP server.
canonical: https://www.wapiworld.com/auth.md
last-updated: 2026-08-29
---

# Wapiworld authentication

Wapiworld credentials are project-scoped. Never place API keys, OAuth tokens, authorization codes, client secrets, or webhook signing secrets in URLs, logs, prompts, or tool output.

## 1. Discover the protected resource

Read [Wapiworld protected-resource metadata](https://www.wapiworld.com/.well-known/oauth-protected-resource). It identifies the MCP resource, the Authrice authorization server, and the supported `wapiworld:read` and `wapiworld:write` scopes.

## 2. Discover the authorization server

Read [Authrice authorization-server metadata](https://api.authrice.com/.well-known/oauth-authorization-server) at runtime. Use the authorization, token, and registration endpoints advertised there rather than hard-coding endpoint paths.

## 3. Register the OAuth client

Use the registration method and metadata advertised by Authrice. Register only redirect URIs controlled by the client. Do not reuse another application's client credentials or claim support for an unadvertised registration method.

## 4. Request authorization

Use the authorization-code grant with PKCE S256. Request `wapiworld:read` for safe project and sender inspection. Add `wapiworld:write` only when the user has asked for a write operation. The user completes consent at the advertised authorization endpoint.

## 5. Exchange the code

Send the authorization code and its PKCE verifier directly to the advertised token endpoint. Keep returned access and refresh tokens out of URLs, source control, telemetry, and assistant messages.

## 6. Call Wapiworld

Connect to [the Wapiworld MCP server](https://mcp.wapiworld.com/mcp) with the access token in the Authorization header. Sending a message is non-idempotent: obtain exact confirmation immediately before the call and never retry it automatically. For REST integrations, follow the [generated API reference](https://www.wapiworld.com/api/) and [OpenAPI contract](https://www.wapiworld.com/openapi.json).

## 7. Refresh, expire, and recover

Use a refresh token only when the current Authrice metadata and token response permit it. On an authentication error, do not repeatedly retry: re-read discovery metadata, verify the resource and minimum scopes, and ask the user to authorize again if consent or credentials have expired.