Auth, tokens & scopes
Two ways in. Assistants connect over OAuth and the student approves in the browser; your own code carries an agent token you mint and revoke yourself.
Assistants: OAuth
OAuth 2.1 with PKCE (S256 only) and dynamic client registration (RFC 7591), which is why adding the connector never asks you for credentials: the client registers itself, resource discovery is served at https://usesyla.app/.well-known/oauth-protected-resource, and you approve the grant in the browser. Revoking it in Syla → Connections cuts the connection off immediately.
Your own code: agent tokens
Minted in Settings → Connections → Your own agents (part of Syla Pro). A token is shown exactly once; Syla stores only a hash. Every one:
- starts with
syla_pat_, so secret scanners recognise one committed by accident - carries only the scopes you picked when you made it
- expires after a year; you can hold ten at a time
- stops working the moment you revoke it, with no cache to wait out
Your first request, everything due in the next week:
curl -s https://usesyla.app/api/mcp \
-H "Authorization: Bearer $SYLA_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "get_upcoming_assignments",
"arguments": { "days_ahead": 7 }
}
}'Scopes
A token grants some of these. There is no Canvas write scope, because there is nothing that writes to Canvas.
| Scope | Grants |
|---|---|
academic:read | Class names, assignments, due dates, grades, announcements, workload. |
materials:read | Find passages in your lectures and readings, and read the excerpts that match. |
files:read | Open the full text of a lecture, reading, or assignment brief. |
changes:read | See what was assigned, moved, or posted since the agent last checked. |
memory:write | Keep a note you explicitly ask it to remember. Never writes to Canvas. |
The useful split is between seeing and opening: a scheduling agent can know a reading was assigned and when it is due without being able to read it. Tools outside a token's scopes do not appear in tools/list, and calling one anyway returns a refusal naming the scope it needed, rather than an empty result an agent would mistake for “nothing found”.