Authentication

Barakah Tasks integrations use OAuth authorization code flow with PKCE. The person reviews requested scopes before a connection is created. An authorization code is single-use, expires after 60 seconds, and is stored only as a SHA-256 digest before exchange.

Choose one resource audience

Surface	OAuth resource
MCP	https://mcp.barakahtasks.com/mcp
REST, Event Log, and webhooks	https://api.barakahtasks.com/

The selected resource is bound to the authorization code, access token, refresh token, and connection. MCP and REST reject tokens issued for the other resource. Omitting resource selects MCP, so REST clients must send the REST resource deliberately.

Entitlement and revocation

Cloud-backed integration access requires the applicable paid entitlement. During the 30-day lapse grace window, the contract may permit authorized REST reads and webhook status or history reads. It does not permit mutations, endpoint verification, replay, reactivation, secret rotation, or callback delivery.

A person can revoke a connection in Barakah Tasks. Revocation prevents future refresh. Existing access tokens are short-lived and expire on their own. A webhook subscription remains bound to the exact REST connection that created it and cannot move silently to another connection.

Exact authorization and token routes are published only from the generated REST contract.