MCP 0.4.2 / Operations
Proxy and cache configuration
Keep OAuth, approval, discovery, and MCP endpoints private and current.
Production sites require HTTPS and pretty permalinks. Reverse proxies and page caches must bypass:
/cointacted-mcp/authorize//cointacted-mcp/approvals//.well-known/oauth-*/wp-json/cointacted-mcp/v1/oauth/*/wp-json/cointacted-mcp/v1/user/mcp
Consent, approval, code, token, and connected-user responses are private short-lived state and must never be served from a shared cache. Preserve authorization headers and the correct public HTTPS origin through the proxy.
After changing proxy rules, test discovery, PKCE authorization, token refresh rotation, approval expiry, disconnect, and a rejected request with an old token.
Was this documentation helpful?Your response helps us improve this page.