OBI's MCP server uses OAuth 2.0 for secure authentication, powered by Supabase.
When an MCP client (like Claude Desktop) connects to OBI, it:
/manifest endpointapp.heyobi.comYour data is protected by Row-Level Security (RLS) - you can only access properties you own or have been granted access to.
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ MCP Client │ │ OBI Server │ │ Supabase │
│ (Claude Desktop)│ │ mcp.heyobi.com │ │ Auth Server │
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
│ │ │
│ 1. GET /manifest │ │
│──────────────────────>│ │
│ │ │
│ 2. Auth URLs │ │
│<──────────────────────│ │
│ │ │
│ 3. Redirect to login │ │
│──────────────────────────────────────────────>│
│ │ │
│ 4. User signs in │ │
│ │ │
│ 5. JWT token │ │
│<──────────────────────────────────────────────│
│ │ │
│ 6. API calls with │ │
│ Bearer token │ │
│──────────────────────>│ │
│ │ 7. Validate token │
│ │──────────────────────>│
│ │ │
│ 8. Response │ │
│<──────────────────────│ │
│ │ │
| Endpoint | URL |
|---|---|
| Authorization | https://app.heyobi.com/oauth/authorize |
| Token | https://oktnratupvznraxkclus.supabase.co/auth/v1/token |
| Scopes | openid, email, profile |
OBI uses Supabase JWT tokens:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Tokens contain:
All tool calls require a valid Bearer token:
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "list_properties",
"arguments": {}
}
}
With header:
Authorization: Bearer <your_jwt_token>
Content-Type: application/json
Your token determines what data you can access:
Attempting to access unauthorized properties returns an error:
{
"error": "Property not found or access denied"
}
{
"statusCode": 401,
"statusMessage": "Unauthorized",
"data": {
"error": "Missing or invalid Authorization header"
}
}
{
"statusCode": 401,
"statusMessage": "Unauthorized",
"data": {
"error": "Invalid or expired token"
}
}
MCP clients handle token refresh automatically. If your session expires:
401 Unauthorized responseFor a seamless experience, keep your OBI session active at app.heyobi.com.
https://mcp.heyobi.com