Layerr authentication and OAuth

Layerr authentication for the product MCP is OAuth 2.0 / OpenID Connect on https://mcp.layerr.ai. Agents should request only the scopes the job needs. The public marketing MCP at https://layerr.ai/mcp does not use tokens.

Authorization-server metadata lives at https://layerr.ai/.well-known/oauth-authorization-server. OpenID Connect discovery is https://layerr.ai/.well-known/openid-configuration. Protected-resource metadata for the product MCP is https://layerr.ai/.well-known/oauth-protected-resource. The issuer, authorize, token, JWKS, and registration URLs in those documents are the live product host — not a mock.

Scopes: openid, profile, and email identify the caller. offline_access issues a refresh token. mcp:tools:read lists product tools the caller can already reach. mcp:tools:invoke runs those tools. mcp:explore:read reads governed Explore catalogs. mcp:explore:query runs governed Explore queries. A token with only read scopes cannot invoke writes.

There is no public API key and no free-tier sandbox. Product access is invited: a thirty-minute call, then credentials for the workspaces you can already reach. Human path: https://layerr.ai/contact. Machine path: https://layerr.ai/openapi.json securitySchemes.oauth2.