Module oauth 

OAuth for the MCP server, so apps that connect only through OAuth (the Claude and ChatGPT web connectors) can reach it. Runlight is both the resource and the authorization server:

• /.well-known/oauth-protected-resource names the MCP endpoint and this server.
• /.well-known/oauth-authorization-server lists the endpoints below.
• POST /oauth/register lets a client register itself (public clients, no secret).
• /oauth/authorize asks the signed-in owner to allow the client, every site or one.
• POST /oauth/token swaps the one-time code, checked with PKCE, for a token.

The token is an ordinary API token, so it appears in Settings, API and AI, beside the others, and deleting it there disconnects the app. It reads stats, or with the “manage” scope (asked for by a Runlight hub) it also changes one site’s settings. With the “cms” scope (asked for by the WordPress, Drupal, and Craft plugins) it is the site’s dashboard key, which only opens its read-only dashboard in the CMS, and the answer also carries the site’s agents key, so connecting fills in the plugin’s settings.

Traits

OAuthHost

What the routes give OAuth: who is asking, where to sign in, and the accounts’ hooks.

Functions

oauth_response

Answers the OAuth paths, or returns None for anything else. path is relative to the routes’ base; the two well-known documents are also answered at the site’s root (/.well-known/...) for clients that look there.

resource_metadata_url

The URL that a 401 from the MCP endpoint points clients at, to start OAuth.

s256

base64url of SHA-256, as PKCE’s S256 method compares.