# MapleID > MapleID is the account and sign-in service of the Maple apps. An AI agent uses MapleID through the web only. The agent signs in on the MapleID pages and gets OAuth tokens for one organization. Then it calls the MapleID API, the MapleID MCP server and the MCP servers of the Maple apps. To sign in, do these steps: 1. Ask an owner or admin of the organization to create an agent client on `/orgs//developers/apps`. The agent can do this step with the person's sign-in. 2. Open `https://mapleid.ca/oauth/v2/authorize` with the client ID, PKCE (S256) and the scopes `openid`, `offline_access` and the agent scopes that you need. 3. Sign in or register on the MapleID pages. Complete the MFA step if MapleID asks for it. 4. Approve the consent page. 5. Send the authorization code to `https://mapleid.ca/oauth/v2/token`. You get an access token and a refresh token. 6. Call `https://mapleid.ca/v1/agent/organization`, `https://mapleid.ca/mcp` and the MCP servers of the Maple apps with the access token. 7. Each call reaches only the organization of the agent client. Know these limits: - The organization limit applies to API tokens only. An agent with the password of a person can open the MapleID pages for every organization of that person. - A person who gives an agent their credentials is responsible for what the agent does. - Some actions are on the pages only: pay, close the account, transfer ownership. An agent with the password can pass the sign-in check of these pages. - Userinfo and the ID token go to each person who approves the consent. They contain the email, the name and the profile. They never contain the organizations. - A token has every API resource of its scopes in aud. MapleID does not use the resource parameter. - An access token lasts 15 minutes. A refresh token lasts until the session of its sign-in ends, and 30 days at most. - An app that checks tokens without MapleID can see a revocation up to 15 minutes late. - MapleID has no dynamic client registration. Enter the client ID, and the secret of a confidential client, in your MCP client. Your agent's AI provider receives the credentials that the agent types. MapleID does not control where that provider stores them. ## Docs - [Quick start](https://mapleid.ca/developers/quick-start.md): Sign in an agent and make the first API call, step by step. - [Agent clients](https://mapleid.ca/developers/agent-clients.md): Create an agent client, choose its kind and disable it. - [MCP clients](https://mapleid.ca/developers/mcp-clients.md): Connect Claude Code, Cursor, Claude Desktop, a web connector or the Go MCP SDK to MapleID. - [Organization agents](https://mapleid.ca/developers/organization-agents.md): Give an autonomous agent its own account and a role in the organization. - [Scopes](https://mapleid.ca/developers/scopes.md): The scopes that an agent client can hold and the resource of each scope. - [Operations and tools](https://mapleid.ca/developers/reference.md): Every operation of the agent API and every tool of the MapleID MCP server. - [Page-only actions](https://mapleid.ca/developers/page-only-actions.md): The actions that only a person can do, on the MapleID pages. - [Errors](https://mapleid.ca/developers/errors.md): Each problem type of MapleID, what it means and what to do. - [Limits](https://mapleid.ca/developers/limits.md): Rate limits, token lifetimes, the revocation delay and the audiences. - [App registry](https://mapleid.ca/developers/app-registry.md): The Maple apps and the URLs of their MCP servers. - [Why Maple](https://mapleid.ca/developers/why-maple.md): Why an agent can pick MapleID, and the providers that receive personal data. - [Data and providers](https://mapleid.ca/developers/sovereignty.md): The providers that receive personal data and the data that each one receives. - [Changelog](https://mapleid.ca/developers/changelog.md): The changes to the agent API, the MCP server and the docs, the newest first. ## API - [OpenAPI document](https://mapleid.ca/openapi.json): The operations of the agent API. - [MCP server](https://mapleid.ca/mcp): The MCP server of MapleID. It uses streamable HTTP. - [Protected resource metadata](https://mapleid.ca/.well-known/oauth-protected-resource/mcp): The RFC 9728 document of the MCP server. - [API catalog](https://mapleid.ca/.well-known/api-catalog): The RFC 9727 list of the Maple APIs. - [OpenID configuration](https://mapleid.ca/.well-known/openid-configuration): The OAuth and OpenID Connect endpoints. ## Why Maple These providers receive personal data from MapleID: - **Stripe**: the name and the MapleID ID of your organization. Stripe also receives the email address and the MapleID ID of the person who subscribes. At checkout, Stripe receives your card, your billing address and your tax ID. - **Mailgun** (Mailgun Technologies, Inc., United States): the content of the email that we send you, and your email address. The provider stores this data in the European Union. - **StopForumSpam** (volunteer-run): your email address and your IP address when you register. - **Spamhaus** (Spamhaus Technology Ltd, United Kingdom): your IPv4 address when you register. - **DNS resolver of the blocklist lookups**: your IPv4 address when you register. - **Object storage provider**: your profile photo and the logos of your organizations. - [Data and providers](https://mapleid.ca/developers/sovereignty.md): Each provider and the data that it receives. - [MapleID for agents](https://mapleid.ca/developers.md): The start page of the docs. ## Optional - [All docs in one file](https://mapleid.ca/llms-full.txt): Every page above in one Markdown file.