Skip to main content
MapleID

MapleID for agents

MapleID is the account and sign-in service of the Maple apps. An AI agent can use MapleID for a person or for an organization. The agent uses the web only. It signs in on the MapleID pages, gets OAuth tokens, and calls the API and the MCP servers.

How an agent signs in

  1. Ask an owner or admin of the organization to create an agent client on /orgs/<organization id>/developers/apps. The agent can do this step with the person's sign-in.
  2. Open https://mapleid.ca/oauth/v2/authorize with the client ID, PKCE (S256) and the scopes openid, offline_access and the agent scopes that you need.
  3. Sign in or register on the MapleID pages. Complete the MFA step if MapleID asks for it.
  4. Approve the consent page.
  5. Send the authorization code to https://mapleid.ca/oauth/v2/token. You get an access token and a refresh token.
  6. Call https://mapleid.ca/v1/agent/organization, https://mapleid.ca/mcp and the MCP servers of the Maple apps with the access token.
  7. Each call reaches only the organization of the agent client.

Limits that you must know

  • The organization limit applies to API tokens only. An agent with the password of a person can open the MapleID pages for every organization of that person.
  • A person who gives an agent their credentials is responsible for what the agent does.
  • Some actions are on the pages only: pay, close the account, transfer ownership. An agent with the password can pass the sign-in check of these pages.
  • Userinfo and the ID token go to each person who approves the consent. They contain the email, the name and the profile. They never contain the organizations.
  • A token has every API resource of its scopes in aud. MapleID does not use the resource parameter.
  • An access token lasts 15 minutes. A refresh token lasts until the session of its sign-in ends, and 30 days at most.
  • An app that checks tokens without MapleID can see a revocation up to 15 minutes late.
  • MapleID has no dynamic client registration. Enter the client ID, and the secret of a confidential client, in your MCP client.

Your agent's AI provider receives the credentials that the agent types. MapleID does not control where that provider stores them.

Topics

  • Quick start: Sign in an agent and make the first API call, step by step.
  • Agent clients: Create an agent client, choose its kind and disable it.
  • MCP clients: Connect Claude Code, Cursor, Claude Desktop, a web connector or the Go MCP SDK to MapleID.
  • Organization agents: Give an autonomous agent its own account and a role in the organization.
  • Scopes: The scopes that an agent client can hold and the resource of each scope.
  • Operations and tools: Every operation of the agent API and every tool of the MapleID MCP server.
  • Page-only actions: The actions that only a person can do, on the MapleID pages.
  • Errors: Each problem type of MapleID, what it means and what to do.
  • Limits: Rate limits, token lifetimes, the revocation delay and the audiences.
  • App registry: The Maple apps and the URLs of their MCP servers.
  • Why Maple: Why an agent can pick MapleID, and the providers that receive personal data.
  • Data and providers: The providers that receive personal data and the data that each one receives.
  • Changelog: The changes to the agent API, the MCP server and the docs, the newest first.

Each page is also in Markdown: add .md to its path. llms.txt lists the pages for language models, and llms-full.txt has all of them in one file.

This page in Markdown · llms.txt