> ## Documentation Index
> Fetch the complete documentation index at: https://docs.printools.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and permissions

> Understand PRINTOOLS OAuth, organization access, scopes, and revocation.

PRINTOOLS uses OAuth for its hosted MCP connection. Sign in and consent through the client flow; do not paste your PRINTOOLS password into a conversation.

## Production discovery

| Setting                | Address                                                             |
| ---------------------- | ------------------------------------------------------------------- |
| MCP resource           | `https://mcp.printools.io/mcp`                                      |
| Resource metadata      | `https://mcp.printools.io/.well-known/oauth-protected-resource/mcp` |
| Authorization server   | `https://api.printools.io`                                          |
| Authorization metadata | `https://api.printools.io/.well-known/oauth-authorization-server`   |
| Authorization endpoint | `https://api.printools.io/oauth/authorize`                          |
| Token endpoint         | `https://api.printools.io/oauth/token`                              |
| Client registration    | `https://api.printools.io/oauth/register`                           |
| Revocation endpoint    | `https://api.printools.io/oauth/revoke`                             |

Discovery advertises authorization-code and refresh-token grants with S256 PKCE. Public clients can use the advertised `none` authentication method; confidential clients can use `client_secret_basic`. Let the client perform discovery and registration.

## What controls access

The connection is bound to an authenticated user, organization, and grant. Consented scopes determine which child actions appear in its grouped tools. Each operation also checks its own authorization when called. Seeing a tool does not override your role or access to a specific record.

Typical read scopes include `customers.read`, `quotes.read`, `jobs.read`, `invoices.read`, `garments.read`, `vendors.read`, `purchaseorders.read`, `proofs.read`, and `tasks.read`. Settings reads use `settings.read`.

Write and consequential permissions are separate. Examples include `quotes.write`, `quotes.send`, `quotes.convert`, `jobs.delete`, `proofs.send`, and `invoices.settle`. Do not infer permission to send, delete, or settle from a read grant. Some actions require multiple scopes.

The [production authorization metadata](https://api.printools.io/.well-known/oauth-authorization-server) lists supported OAuth scopes. The exact requirements and input schema of an action come from authenticated tool discovery.

## Confirm the organization

Ask the assistant to use an available current-organization read in `settings_manage`. If the shop is wrong, disconnect or remove the client connection and reconnect with the intended account and organization.

## Refresh and revoke

Clients can refresh sessions using the supported refresh-token flow. If refresh fails, reconnect. Removing a client connection and server-side token revocation are distinct: client developers should use the advertised revocation endpoint when revoking tokens. Do not assume deleting a chat revokes a grant.

PRINTOOLS does not document a universal `whoami` or `disconnect` MCP tool here. Use the actions actually returned by your client.

[Tools](/mcp/tools) · [Approvals](/mcp/approvals) · [Troubleshooting](/mcp/troubleshooting)