Authentication

Barakah Tasks MCP uses the OAuth authorization code flow with PKCE. The person reviews requested scopes before a connection is created. An authorization code is single-use, expires after 60 seconds, and is stored only as a SHA-256 digest before exchange.

MCP resource

The protected resource is:

https://mcp.barakahtasks.com/mcp

The server publishes OAuth authorization-server metadata and RFC 9728 protected-resource metadata. Tokens are accepted only for the MCP resource and the issuer that minted them. PKCE uses the S256 challenge method.

Entitlement and revocation

A signed-in Free account can connect and use the core MCP surface: tasks, Lists, Notes, Memory, prayer-anchored scheduling, and Event Log reads. Premium is required for cloud file attachments, Google Calendar availability, hosted place search, webhook subscriptions, and more than one active connection. Scope approval does not bypass ownership, membership, feature, or entitlement checks.

The tool listing is filtered per connection: a tool is advertised exactly when that connection is allowed to call it, so a host never shows a tool that would fail the gate.

Plan changes reach an existing connection unevenly. Cloud file attachments, hosted place search, and the higher connection limit are evaluated against the current plan on every call, so they become available on an existing connection without reconnecting. Google Calendar and webhook subscriptions rest on scopes a Free account cannot be granted, so a connection approved while the account was Free never holds them and upgrading does not add them. Disconnect and reconnect in the host to approve those scopes.

A person can revoke a connection in Barakah Tasks. Revocation prevents future refresh, and access tokens are short-lived. The server reloads the current connection on protected calls so revoked or superseded connections fail closed.

Never paste an access token or refresh token into a chat, support request, or workflow step.