Skip to main content
SIA Studio uses Firebase identity behind a remote OAuth MCP gateway. Sign in through the client’s native authorization flow. Each client receives its own authorization for the connected SIA account. Access to saved work also depends on current Storyworld membership.

​
Scope guide

The tool reference lists the scope required for each operation. The runtime’s advertised security metadata and authorization checks are authoritative. An initial read-only grant does not make the endpoint’s complete tool catalog read-only.

​
Permission upgrades

A tool may report insufficient_scope with an OAuth challenge. Use the client’s native reconnect or additional-permission flow and review the new SIA consent screen. If the host cannot handle that flow, configure the intended scopes through its supported settings and reconnect. Do not edit an authorization URL or copy credentials manually. Granting generation permission permits supported calls; it is not itself a request to generate or spend. Existing account billing and the user’s creative request still apply.

​
Renewal and expiry

When the client requests offline_access, SIA offers an unchecked Stay connected for up to 30 days option. Leaving it off gives no refresh token. Short sessions may require another native sign-in after expiry. The optional renewable connection remains subject to its maximum age, current membership and revocation.

​
Disconnecting

Open Manage connections, sign in to SIA and revoke the relevant client. Also remove it from the client’s own settings if desired. Revoking access is separate from deleting saved assets or cancelling provider work already admitted. If a job was interrupted, reconnect the original client and inspect its saved operation before attempting a replacement. Operation ownership and recovery are not automatically transferable to a different client.

​
For client developers

Use standard OAuth discovery, PKCE, validated redirect registration and the canonical resource https://mcp.sia.vision/studio. Desktop callbacks may use a temporary localhost address belonging to the client; do not substitute that address for the resource URL. Keep tokens in the client’s supported secure storage. Never put bearer tokens, refresh tokens or upload capabilities in prompts, source control, screenshots or documentation. Enterprise-managed authorization and trusted-issuer auto-connect are separate integration work; they are not currently promised by the basic OAuth connector.