OAuth Quick Start Guide

🚀 Get Started in 2 Minutes

Step 1: Open Settings

1. Go to your Frappe site
2. Search for "Assistant Core Settings"
3. Click the OAuth tab

Step 2: Enable OAuth

Check the box: ✅ Enable Dynamic Client Registration

Step 3: Configure Client Access

For MCP Inspector (testing): In "Allowed Public Client Origins", add:

http://localhost:6274

For Claude Desktop: Leave "Allowed Public Client Origins" blank (Claude Desktop doesn't need it)

For your web app: Add your app's URL:

https://your-app.com

Step 4: Save

Click Save button

---

✅ That's It!

Your OAuth is now configured. MCP clients can auto-register and connect.

---

🧪 Test with MCP Inspector

1. Open http://localhost:6274/
2. Select "Streamable HTTP"
3. Enter your MCP endpoint URL:

   https://your-frappe-site.com/api/method/frappe_assistant_core.api.fac_endpoint.handle_mcp

4. Click "Open Auth Settings"
5. Click "Quick OAuth Flow"
6. Authorize when prompted ✅

---

🎯 What You See

Main Section (Always Visible)

┌─────────────────────────────────────────────┐
│ OAuth Configuration                         │
├─────────────────────────────────────────────┤
│ ☑ Enable Dynamic Client Registration        │
│                                             │
│ Allowed Public Client Origins:              │
│ ┌─────────────────────────────────────────┐ │
│ │ http://localhost:6274                   │ │
│ │ https://your-app.com                    │ │
│ └─────────────────────────────────────────┘ │
└─────────────────────────────────────────────┘

Advanced Settings (Collapsed)

Don't touch these unless you know what you're doing!

Click to expand "Advanced OAuth Settings" only if needed.

Resource Metadata (Collapsed)

Optional branding info - skip for now

Click to expand "Resource Metadata" only if you want to customize URLs.

---

🔒 Security Quick Tips

✅ DO:

• Use specific URLs in "Allowed Public Client Origins"
• Use HTTPS in production
• Keep "Skip Authorization Prompt" disabled

❌ DON'T:

• Use * in production (allows all origins)
• Enable "Skip Authorization Prompt" in production
• Share OAuth client secrets

---

🐛 Common Issues

"Dynamic client registration is not enabled"

→ Check the box: ✅ Enable Dynamic Client Registration

"CORS error"

→ Add your client's URL to "Allowed Public Client Origins"

"redirect_uris must be https"

→ Use https:// or http://localhost: only

---

📚 Need More Help?

Read the full guide: OAuth Setup Guide

---

🎉 You're All Set!

Your Frappe Assistant Core is now OAuth-enabled and ready for MCP clients.

Questions? Open an issue: https://github.com/buildswithpaul/Frappe_Assistant_Core/issues