Consent Grants

A consent grant is a time-limited bearer token that defines exactly which tools an agent can use.

Creating a Grant

curl -X POST https://api.wardenauthz.com/v1/scope/{orgId}/mcp/consent \
  -H "x-api-key: ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "subjectId": "agent-1",
    "servers": [
      { "serverKey": "github", "tier": "low" },
      { "serverKey": "slack", "tier": "medium" }
    ],
    "expiresInSeconds": 3600
  }'

{
  "token": "mcp_bearer_eJx1VU...",
  "grantId": "grant-abc123",
  "expiresAt": "2026-07-14T12:00:00Z"
}

How It Works

The tier on each server entry limits which tools are available:

Server	Grant Tier	Available Tools
github	low	list_issues (low), read_repo (low)
slack	medium	All low + medium tools

merge_pr (high tier) is NOT available because the grant only allows up to low.

Portal vs Pinned Mode

Portal Mode (default)

One connection gives access to all servers in the grant. Tools are namespaced: github__list_issues, slack__post_message.

Pinned Single-Server (Option B)

Connect to a specific server by URL. Useful when different agents need different server access:

https://public.wardenauthz.com/mcp/github   → GitHub only
https://public.wardenauthz.com/mcp/slack     → Slack only

The same bearer token works for all — WardenAuth filters to the pinned server.

Grant Lifecycle

Action	Description
Create	Issue a new bearer token with specific servers and tiers
Use	Pass as Authorization: Bearer <token> in MCP requests
Expire	Token stops working after expiresInSeconds
Revoke	Immediately invalidate via API or dashboard

Revoke a grant:

curl -X POST https://api.wardenauthz.com/v1/scope/{orgId}/mcp/consent/{grantId}/revoke \
  -H "x-api-key: ak_live_..."

Short-Lived Tokens

Issue grants with short expiry (1–24 hours) and rotate them. This limits the blast radius if a token is leaked. Use the SDK to automate grant rotation in your agent deployment pipeline.

Full API Reference

Complete request/response schemas, examples, and try-it-out are available in the API Reference.