> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sia.vision/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and permissions

> Per-client OAuth, least-privilege scopes, renewal and revocation.

SIA Studio uses Firebase identity behind a remote OAuth MCP gateway. Sign in through the client’s native authorization flow. Each client receives its own authorization for the connected SIA account. Access to saved work also depends on current Storyworld membership.

## Scope guide

| Scope | Purpose |
| - | - |
| `account:read` | Identify the connected account. Required for MCP access. |
| `studio:read` | Read saved Storyworlds, assets and references. |
| `character:draft` | Create a bounded Character draft from a saved reference. |
| `studio:write` | Save supported asset/workspace changes and references. |
| `studio:generate` | Request supported asset media generation. |
| `production:read` | Read supported Production state, jobs and retained media. |
| `production:write` | Save supported Scene, shot, review and cut changes. |
| `production:generate` | Request supported Production planning/media jobs. |
| `offline_access` | Optional token renewal under the connection’s 30-day limit. |

The tool reference lists the scope required for each operation. The runtime’s advertised security metadata and authorization checks are authoritative. An initial read-only grant does not make the endpoint’s complete tool catalog read-only.

## Permission upgrades

A tool may report `insufficient_scope` with an OAuth challenge. Use the client’s native reconnect or additional-permission flow and review the new SIA consent screen. If the host cannot handle that flow, configure the intended scopes through its supported settings and reconnect. Do not edit an authorization URL or copy credentials manually.

Granting generation permission permits supported calls; it is not itself a request to generate or spend. Existing account billing and the user’s creative request still apply.

## Renewal and expiry

When the client requests `offline_access`, SIA offers an unchecked **Stay connected for up to 30 days** option. Leaving it off gives no refresh token. Short sessions may require another native sign-in after expiry. The optional renewable connection remains subject to its maximum age, current membership and revocation.

## Disconnecting

Open [Manage connections](https://mcp.sia.vision/connections), sign in to SIA and revoke the relevant client. Also remove it from the client’s own settings if desired. Revoking access is separate from deleting saved assets or cancelling provider work already admitted.

If a job was interrupted, reconnect the original client and inspect its saved operation before attempting a replacement. Operation ownership and recovery are not automatically transferable to a different client.

## For client developers

Use standard OAuth discovery, PKCE, validated redirect registration and the canonical resource `https://mcp.sia.vision/studio`. Desktop callbacks may use a temporary localhost address belonging to the client; do not substitute that address for the resource URL.

Keep tokens in the client’s supported secure storage. Never put bearer tokens, refresh tokens or upload capabilities in prompts, source control, screenshots or documentation. Enterprise-managed authorization and trusted-issuer auto-connect are separate integration work; they are not currently promised by the basic OAuth connector.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.