duun

Developer Apps

Connect your app to duun MCP

Build a private OAuth client using Authorization Code with PKCE S256. Developer Apps are public clients, so no client secret is issued or required.

Open Developer Apps OAuth metadata

Connection quick reference

Copy these values into your OAuth and MCP client configuration.

MCP endpoint https://duun.app/mcp
Authorization endpoint https://duun.app/oauth/authorize
Token endpoint https://duun.app/oauth/token
OAuth metadata https://duun.app/.well-known/oauth-authorization-server
Protected resource metadata https://duun.app/.well-known/oauth-protected-resource
Client authentication: none Grant: authorization_code PKCE: S256 required Refresh tokens: supported

Authorization flow

Your app owns the PKCE verifier and callback handling. duun authenticates the paid app owner and asks them to approve the requested scopes.

  1. 1

    Register the app

    Create a Developer App in Settings, register every exact callback URI, and copy the public Client ID. Hosted callbacks require HTTPS; loopback development callbacks may use HTTP.

  2. 2

    Generate PKCE and redirect to authorization

    Create a high-entropy verifier, derive its SHA-256 base64url challenge, store the verifier temporarily, and send the user to:

    Authorization request 
    https://duun.app/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_EXACT_REDIRECT_URI&scope=tasks%3Aread%20tasks%3Acreate&state=RANDOM_STATE&code_challenge=BASE64URL_SHA256_CHALLENGE&code_challenge_method=S256
  3. 3

    Validate the callback

    Confirm that the returned state matches the value your app stored. Authorization codes are short-lived and single-use, so exchange them immediately.

  4. 4

    Exchange the code without a client secret

    Send the original verifier and the same redirect URI used during authorization.

    Token exchange 
    curl https://duun.app/oauth/token \
  -H 'content-type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'code=AUTHORIZATION_CODE' \
  --data-urlencode 'redirect_uri=YOUR_EXACT_REDIRECT_URI' \
  --data-urlencode 'code_verifier=YOUR_ORIGINAL_VERIFIER'
  5. 5

    Call MCP

    Send the access token as a Bearer token. The granted scopes and Developer App tool policy both limit the available tools.

    List available tools 
    curl https://duun.app/mcp \
  -H 'authorization: Bearer ACCESS_TOKEN' \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":"tools","method":"tools/list"}'