Security and Data Use
WriteByte uses OAuth-backed MCP connections, keeps the public author tool surface separate from internal admin tooling, and applies shared-store request limits.
Last updated July 17, 2026
Security facts
- OAuthPublic AI integrations use OAuth 2.1 authorization code with PKCE and browser consent.
- TokensWriteByte stores OAuth clients, access tokens, and refresh tokens server-side.
- SurfacePublic connectors expose non-admin author tools only. Admin review and editorial tools stay internal.
- TransportMCP requests are stateless and may be served by any healthy application replica.
- LimitsOAuth and MCP request limits use a shared Postgres counter and return explicit retry guidance.
Public AI integrations use OAuth 2.1 authorization code + PKCE. The MCP surface validates WriteByte-issued bearer tokens for the protected resource, and users approve the connection in the browser before a host can call any author tools.
The public MCP endpoint exposes the non-admin author surface only. Internal admin triage and editorial tools live on a separate admin route and are not part of public ChatGPT or Claude packaging.
MCP calls are self-contained and do not depend on in-memory session affinity. OAuth client registration, token exchange, authorization, and MCP traffic are protected by shared-store limits that work consistently across application replicas.
To report a security concern, email support@writebyte.org with the subject line "Security report". General privacy expectations are summarized on the Privacy Policy.