MCP — for your Subscribers

Let each of your subscribers connect their own AI agent to your content, tied to their existing login and their plan. Usage comes back to you per subscriber and per tier.

Miso runs the OAuth exchange with the AI agent. Your site provides the login and, on the way back, a signed token that proves who the subscriber is. It is a single round-trip.

Looking for one shared credential for your own team or a single application? See MCP Server for Internal Use. The search and detail tools are the same in both setups — only the sign-in differs.

Which setup do I want?

	Internal use	For your subscribers
Who connects	Your team, or one application you run	Each subscriber, in their own agent
Credential	One token for the whole app	One access token per subscriber
Sign-in	None. You hold the token	Your existing login
Usage reports	Per app	Per subscriber and tier
Your build	Paste a URL	A login hand-off, described below

The round-trip

sequenceDiagram
    autonumber
    actor S as Subscriber
    participant A as AI Agent
    participant M as Miso
    participant Y as Your site

    S->>A: Click "Authenticate"
    A->>M: Reach the Miso OAuth endpoint
    M-->>S: Redirect to your sign-in
    Note over S,Y: These two steps happen on your site
    S->>Y: Sign in, and enable MCP for this plan
    Y-->>M: Redirect back with a signed JWT
    M->>M: Verify the assertion (HS256, your key)
    M-->>A: Issue an OAuth access token
    A->>M: MCP requests with that token
    Note over M,Y: Usage reported to you, by subscriber and tier

What your site needs

You do not need to build an identity provider. If you have a login and can sign a token, you have the pieces. Three things:

1. A sign-in page Miso can redirect to. Miso sends the subscriber to your login with two query parameters — a state and the callback URL to return to. The subscriber signs in with their existing account. You confirm that their plan includes MCP.

2. A redirect back with a signed assertion. Send the subscriber to the callback carrying a short-lived JWT. Sign it with your Miso secret key (HS256). That shared secret is how Miso knows the assertion came from you.

3. The right claims in that assertion.

Claim	What it is
`sub`	A stable subscriber id. Who the access is for.
`access_exp`	How long MCP access stays valid.
`state`	Echo the `state` Miso sent you. This blocks CSRF.
`aud`	The audience: `https://api.askmiso.com`.
`exp`	The lifetime of this assertion. Keep it under 5 minutes.
`tier`	Optional. The plan tier, to segment your usage reports.

GET https://your-site.com/login
  ?state=Yk3f...opaque
  &callback=https://api.askmiso.com/v1/ask/oauth/callback

Signing the assertion

After the subscriber signs in, and after you confirm their entitlement, sign a short-lived assertion and redirect them back.

import time, jwt                      # pip install pyjwt
from urllib.parse import urlencode

def redirect_back(state, callback, subscriber_id, tier):
    now = int(time.time())
    assertion = jwt.encode(
        {
            "sub": subscriber_id,      # stable subscriber id
            "aud": "https://api.askmiso.com",
            "state": state,            # echo Miso's state
            "exp": now + 120,          # keep this short
            "access_exp": now + 30 * 24 * 3600,
            "tier": tier,              # optional, for reports
        },
        MISO_SECRET_API_KEY,           # your Miso secret key
        algorithm="HS256",
    )
    params = {"state": state, "assertion": assertion}
    return redirect(f"{callback}?{urlencode(params)}")

import jwt from "jsonwebtoken";       // npm i jsonwebtoken

function redirectBack(res, state, callback, subscriberId, tier) {
  const now = Math.floor(Date.now() / 1000);
  const assertion = jwt.sign(
    {
      sub: subscriberId,              // stable subscriber id
      aud: "https://api.askmiso.com",
      state,                          // echo Miso's state
      exp: now + 120,                 // keep this short
      access_exp: now + 30 * 24 * 3600,
      tier,                           // optional, for reports
    },
    MISO_SECRET_API_KEY,              // your Miso secret key
    { algorithm: "HS256" }
  );
  const params = new URLSearchParams({ state, assertion });
  return res.redirect(`${callback}?${params}`);
}

<?php
use Firebase\JWT\JWT;   // composer require firebase/php-jwt

function redirect_back($state, $callback, $subscriber_id, $tier) {
    $now = time();
    $assertion = JWT::encode(
        [
            'sub'        => $subscriber_id,  // stable subscriber id
            'aud'        => 'https://api.askmiso.com',
            'state'      => $state,          // echo Miso's state
            'exp'        => $now + 120,      // keep this short
            'access_exp' => $now + 30 * 24 * 3600,
            'tier'       => $tier,           // optional, for reports
        ],
        MISO_SECRET_API_KEY,                 // your Miso secret key
        'HS256'
    );
    $q = http_build_query([
        'state'     => $state,
        'assertion' => $assertion,
    ]);
    header("Location: {$callback}?{$q}");
    exit;
}

require "jwt"                         # gem install jwt

def redirect_back(state, callback, subscriber_id, tier)
  now = Time.now.to_i
  assertion = JWT.encode(
    {
      sub: subscriber_id,             # stable subscriber id
      aud: "https://api.askmiso.com",
      state: state,                   # echo Miso's state
      exp: now + 120,                 # keep this short
      access_exp: now + 30 * 24 * 3600,
      tier: tier                      # optional, for reports
    },
    MISO_SECRET_API_KEY,              # your Miso secret key
    "HS256"
  )
  query = URI.encode_www_form(state: state, assertion: assertion)
  redirect_to "#{callback}?#{query}"
end

That is the whole integration on your side. Miso handles discovery, PKCE, and the token exchange with the agent.

Who does what

Step	Your site	Miso
Start	—	Receives the agent and begins OAuth.
Sign-in	Login, and enable MCP for the plan.	Redirects the subscriber to you.
Hand-back	Redirect back with a signed JWT.	Verifies the JWT.
Token	—	Issues the access token to the agent.
Reporting	Receives usage reports.	Attributes usage from your claims.

Availability. Subscriber sign-in is set up with Miso, not self-serve. It needs a short working session with your engineers to agree the login URL, the signing key, and how you map a signed-in user to a subscriber id and tier. Most publishers pilot it on a single tier first. Contact your Miso representative.

The tools your subscribers get

Once connected, a subscriber's agent sees the same two tools as the internal setup: a search tool named for your brand, and a detail tool that returns the full text of one result. See MCP Server for Internal Use for the parameters, the response shape, and the content protections that apply to both.

MCP — Internal Use

Answer Metrics (Dojo)