Sign-in
OAuth 2.1 for apps such as Claude and ChatGPT, a key for your own agents. Every call requires sign-in, and consent applies per server.
Each of the two servers needs an Athaus account, even for initialize and tools/list. There are two ways:
- OAuth 2.1, when an app acts for you (Claude, ChatGPT, Cursor, VS Code). You sign in in the browser and give your consent.
- An
ath_key, when your own agent runs without a browser. It only works with Athaus für Makler. See Keys.
How sign-in works
The app asks
The app calls the server and gets 401 with a WWW-Authenticate header. It names the rights of this server and where the server describes its sign-in, for Athaus für Makler for example:
WWW-Authenticate: Bearer scope="lesen vorschlagen freigeben", resource_metadata="https://anbieter.mcp.athaus.ai/.well-known/oauth-protected-resource/mcp"You sign in to Athaus
If you are not signed in to the Athaus app, Athaus sends you a code by email. There is no password.
You give your consent
On app.athaus.ai/verbinden you see which app wants to connect to which server and what it may do. The server follows from the address you entered in the app; you do not pick a side here. Only the rights of this server are shown:
- The base right (
lesenfor Athaus für Makler,suchenfor the search server) is always on. Without it the connection opens nothing. vorschlagenandsuchauftraegeare on if the app asks for them.- The boundary right (
freigebenoranfragen) stays off until you switch it on, unless you have given it to this app on this server before.
Athaus für Makler needs an account with the provider side set up; otherwise the page says how to set it up. If an app registered itself, the page says that its name has not been verified. Only connect it if you just set it up yourself.
The app works
It gets a token that is valid for one hour and can be refreshed. It only works at the server you consented to: at the other one it gets 401, even if the same app has connected both. Athaus checks the consent again on every call: disconnecting blocks the app immediately, not when the token expires.
Connecting again
Before the two servers there was one at https://api.athaus.ai/mcp, and a consent applied to it. Such a consent no longer opens anything at the new servers. If you had connected an app with the old address:
- Remove the old entry in the app. The old address only answers
410anyway. - Add the matching new address (Installation).
- Sign in and give your consent again.
The same goes for event subscriptions: they are created anew at the new address, with the new event names.
Disconnecting
In the app under Settings, MCP server, in the section Connected apps. An app that has connected both servers shows up twice, and you disconnect each connection on its own. Disconnecting also ends every event subscription of that connection.
For client developers
| Athaus für Makler | Athaus Immobiliensuche | |
|---|---|---|
| Protected resource | https://anbieter.mcp.athaus.ai/mcp | https://suche.mcp.athaus.ai/mcp |
| Resource metadata | https://anbieter.mcp.athaus.ai/.well-known/oauth-protected-resource/mcp | https://suche.mcp.athaus.ai/.well-known/oauth-protected-resource/mcp |
| Scopes | lesen, vorschlagen, freigeben | suchen, suchauftraege, anfragen |
For both:
| Authorization server | https://www.athaus.ai/api/auth, the same for both servers |
| Flow | Authorization code with PKCE, refresh token |
| Registration | Client ID Metadata Document (Claude, ChatGPT) or Dynamic Client Registration (Cursor and others) |
| Further scopes | openid, profile, email, offline_access |
| Resource | Required: resource (RFC 8707) names the server's address. The token carries it as aud and only works there; a token without a resource opens no server |
| Token | JWT, valid for one hour; DPoP is supported |
The same client (claude.ai, for example) connects both servers, each with its own consent. A code or refresh token for one resource gets nothing at the other.
If a token lacks a right, the server answers 403 with error="insufficient_scope". The scope then lists the rights the token already has plus the missing one, never a right of the other server, so the app can ask for exactly that. An invalid, expired or revoked token, or one issued for the other server, gets 401 with error="invalid_token".
While Athaus is closed, only an approved address can consent to a new connection. Existing connections keep working.