{"slug": "flare-now-uses-oauth-for-mcp-the-cli-and-api", "title": "Flare now uses OAuth for MCP, the CLI, and API", "summary": "Flare, the error-tracking service for Laravel, now supports OAuth for its MCP server, CLI, and REST API, replacing API tokens with browser-based consent and granular permissions. MCP clients like Claude Code, Claude Desktop, Codex, Cursor, and OpenCode can connect via a single command, with connections defaulting to read-only access and scoped to teams or projects. The CLI uses the same OAuth flow, including a device code option for headless servers, and all connections are managed under Account → Connections. The update is built on Laravel Passport, with legacy API tokens still working but no longer creatable.", "body_md": "Hooking an AI tool up to Flare's MCP server used to mean creating an API token and pasting it into a config file. That token had full admin access, everywhere. Not very secure, and a lot of extra steps. We've solved both of these problems: MCP clients now sign in to Flare with OAuth from your browser, and you decide exactly how much access each one gets.\n\n## Add Flare to your agent in one command\n\nIn Claude Code, for example:\n\n```\nclaude mcp add --transport http flare https://flareapp.io/mcp\n```\n\nThe first time the client connects, it registers itself with Flare and opens your browser to approve the connection. That's the whole setup. The same flow works in Claude Desktop, Codex, Cursor, OpenCode, and any other MCP client that supports OAuth login.\n\nThis flow is my favorite part of the update. Nothing kills productivity like stopping halfway through a task to create an API token, pick permissions, and paste a key into a config file. Now it's one approve button and I'm back to work.\n\n## Let your AI investigate safely in read-only mode\n\nOn the consent screen you choose between read, write, and admin access per connection, and you scope it to specific teams or even individual projects. MCP connections start out with read-only access on purpose: an agent that's investigating doesn't need more, and you can always grant more later.\n\nWant Claude to investigate errors in one project but never resolve anything or touch any settings? Grant it read access to that project and nothing else. Flare enforces it on every request so a rogue agent can't quietly resolve your errors or change your notification settings. Seeing how often OpenAI and Anthropic have AI agents hack their way out of their sandboxes, this seems like a good idea to have.\n\n## The CLI signs in the same way\n\nRun `flare login`\n\nand your browser opens the same consent screen. You give the connection a name (Flare suggests your computer's name), pick its permissions, and you're logged in. You never see a token, let alone copy one.\n\nOn a server without a browser, `flare login --device`\n\nshows a short code instead. Enter it on flareapp.io from any machine and the CLI picks it up from there.\n\n## One page for all your connections\n\nEvery MCP client and CLI login shows up under Account → Connections, where you can see its permissions and when it was last used. From there you can revoke a single connection or edit its access. Changes to team and project grants apply immediately, without the tool having to log in again.\n\n## Better API authentication too\n\nThe same permission model now backs the REST API. Each personal access token can have read, write, or admin access, can be limited to specific teams or projects, and always expires after a year.\n\nIf you still have old API tokens, they'll keep working for now, but you can't create new ones. The legacy page will stick around until you've revoked your last old token.\n\n## Behind the scenes: Laravel Passport\n\nAll of this is built on [Laravel Passport](https://laravel.com/docs/passport), one of our favorite packages. Passport handles the OAuth heavy lifting: authorization code with PKCE for the browser flow, the device grant for headless logins, and refresh token rotation with replay detection. We added Flare's permission model and resource-bound tokens for the API and MCP server on top. If you're adding OAuth to a Laravel app, start there.\n\n## Try it\n\n[Connect your MCP client](https://flareapp.io/docs/flare/general/our-mcp-server) to `https://flareapp.io/mcp`\n\n, or install the CLI with `composer global require spatie/flare-cli`\n\nand run `flare login`\n\n. The details are in the [CLI docs](https://flareapp.io/docs/flare/general/using-the-cli) and the [API docs](https://flareapp.io/docs/flare/general/using-the-api).\n\n[Back to overview](https://flareapp.io/blog)\n\n## Continue reading\n\n[\nFlare news\n·\nJuly 3, 2026\n](https://flareapp.io/blog/bringing-flare-back-to-laravel-10-and-php-81)\n\n## Bringing Flare back to Laravel 10 and PHP 8.1\n\nFlare now supports Laravel 10 and PHP 8.1 again, so older apps get performance monitoring and logs too. Here’s how we did it.\n\nRuben\n\n[\nFlare news\n·\nJune 30, 2026\n](https://flareapp.io/blog/your-laravel-routes-can-carry-metadata-now-and-flare-shows-it)\n\n## Your Laravel routes can carry metadata now, and Flare shows it\n\nLaravel added a new way to attach metadata to routes, and Flare now automatically shows it on errors and traces\n\nRuben\n\n## Subscribe to Backtrace, our quarterly Flare newsletter\n\nNo spam, just news & product updates", "url": "https://wpnews.pro/news/flare-now-uses-oauth-for-mcp-the-cli-and-api", "canonical_source": "https://flareapp.io/blog/flare-now-uses-oauth-for-mcp-clients-the-cli-and-the-api", "published_at": "2026-08-06 13:00:06+00:00", "updated_at": "2026-08-09 12:13:27.976874+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools"], "entities": ["Flare", "Laravel Passport", "Claude Code", "Claude Desktop", "Codex", "Cursor", "OpenCode", "Spatie"], "alternates": {"html": "https://wpnews.pro/news/flare-now-uses-oauth-for-mcp-the-cli-and-api", "markdown": "https://wpnews.pro/news/flare-now-uses-oauth-for-mcp-the-cli-and-api.md", "text": "https://wpnews.pro/news/flare-now-uses-oauth-for-mcp-the-cli-and-api.txt", "jsonld": "https://wpnews.pro/news/flare-now-uses-oauth-for-mcp-the-cli-and-api.jsonld"}}