Invoice My Clients MCP OAuth

The Invoice My Clients MCP server supports the OAuth 2.0 authorization code flow with PKCE for Streamable HTTP MCP clients such as Claude, ChatGPT, Claude Code and Cursor. Add https://mcp.invoicemyclients.com/mcp as the server URL; the client finds everything else itself.

Discovery URLs

• Protected resource metadata: https://mcp.invoicemyclients.com/.well-known/oauth-protected-resource (also at /.well-known/oauth-protected-resource/mcp). An unauthenticated request to https://mcp.invoicemyclients.com/mcp answers 401 with WWW-Authenticate: Bearer resource_metadata="...".
• Authorization server metadata: https://mcp.invoicemyclients.com/.well-known/oauth-authorization-server
• MCP endpoint (the resource): https://mcp.invoicemyclients.com/mcp

OAuth endpoints

• Dynamic client registration (RFC 7591): https://mcp.invoicemyclients.com/oauth/register
• Client ID Metadata Documents: supported. Send your HTTPS metadata document URL as client_id and skip registration.
• Authorization: https://mcp.invoicemyclients.com/oauth/authorize
• Token (authorization_code and refresh_token, application/x-www-form-urlencoded or JSON): https://mcp.invoicemyclients.com/oauth/token
• Revocation (RFC 7009): https://mcp.invoicemyclients.com/oauth/revoke

Supported scopes

• imc.read: read invoices, clients, reports, projects and related records. This is the default when no scope is requested.
• imc.write: create, update, delete, log, record and convert records.
• imc.send: send invoices and proposals, schedule sends, start recurring invoices and resume reminders. On the live production account these are always refused for AI and MCP clients; the user does them in the app.
• imc.credit: run client credit checks.
• offline_access: a refresh token, so the connection survives the one-hour access token. Clients registered with the refresh_token grant get one as well.

Every scope is shown to the user on a consent screen, with your client name and redirect host, before any code is issued.

Flow summary

1. Your MCP client discovers this resource at /.well-known/oauth-protected-resource.
2. It identifies itself with a Client ID Metadata Document URL, or registers a public client at /oauth/register.
3. It opens /oauth/authorize with response_type=code, a registered redirect_uri (loopback http://localhost and http://127.0.0.1 redirects match on any port), and PKCE S256.
4. The user signs in with Invoice My Clients and approves (or denies) your client on the consent screen. A denial returns error=access_denied. Every redirect carries iss (RFC 9207).
5. The client exchanges the authorization code at /oauth/token for an access token (one hour) and a refresh token.
6. The client calls https://mcp.invoicemyclients.com/mcp with Authorization: Bearer <access_token> and refreshes with grant_type=refresh_token. Refresh tokens rotate: each one works once, a reused one ends the connection.

Plans

Every Invoice My Clients plan, including Free and Starter, can connect an AI client with OAuth. The plan's own limits (for example the number of invoices per month) apply to what the AI client does, exactly as in the app. API keys and plain bearer tokens are for the Professional plan and above.

Disconnecting

Remove the connector in your AI client, or sign out everywhere in Invoice My Clients, to end the connection. A revoked or expired refresh token answers invalid_grant.

API key fallback

If your MCP client cannot complete OAuth, and your account is on the Professional plan or higher, create an API key in Invoice My Clients under Settings → Developer → API Keys and pass it as:

Authorization: Bearer imc_live_YOUR_KEY

For product documentation, see the MCP server feature page. Support: support@invoicemyclients.com.