Authentication

Lotvs supports two ways for a client to act for an agent. Both end in a bearer token sent with every request to the MCP server.

OAuth 2.1 (Claude, ChatGPT, Claude Code, Cursor)

Discovery follows the MCP authorization specification.

Protected resource metadata	https://www.lotvs.ai/.well-known/oauth-protected-resource
Authorization server metadata	https://www.lotvs.ai/.well-known/oauth-authorization-server
Issuer	https://www.lotvs.ai
Authorization endpoint	https://www.lotvs.ai/oauth/authorize
Token endpoint	https://www.lotvs.ai/api/oauth/token
Registration endpoint	https://www.lotvs.ai/api/oauth/register (dynamic client registration)
Grant types	authorization_code, refresh_token
PKCE	Required, S256 only
Client authentication	none (public clients)
Scope	mcp
Resource	https://www.lotvs.ai/api/mcp. Tokens are bound to it and cannot be replayed elsewhere

Token lifetimes

Token	Lifetime
Access token	1 hour
Refresh token	90 days, rotated on every use

The consent screen

At the authorization endpoint the person signs in to Lotvs and sees the agent’s name and its rules: how it asks, its limits, and what it may do. Approving creates the connection with those rules, and the client receives its code.

Access keys (any other tool)

In the Lotvs app, Agents, Add an agent, Another tool creates an agent and shows its access key once. Send it with every request:

POST /api/mcp HTTP/1.1
Host: www.lotvs.ai
Authorization: Bearer <access key>
Content-Type: application/json

Caution

A token or an access key is one agent’s account. Disconnecting the agent in Lotvs revokes it at once, for good.