Dato Agent: sign-in fails with HTTP 401 invalid_client, OAuth endpoints moved to oauth.datocms.com #156

Summary

Dato Agent (Beta) can no longer connect to DatoCMS. Clicking Connect fails immediately with:

Dynamic client registration failed with HTTP 401 (invalid_client)

"Start sign-in again with a new registration" fails the same way. This happens before any model provider call, so the AI provider key and model settings are not involved.

Affected versions

• 0.1.6 (marketplace)
• 0.2.0 (latest on npm, current master)

Steps to reproduce

1. Install Dato Agent (Beta), configure a provider key and model.
2. Open Agent (Beta) and click Connect.
3. The error above appears; no authorization popup is shown.

Cause

dato-agent/src/lib/oauth.ts hardcodes the OAuth endpoints under the MCP server:

export const MCP_BASE_URL = 'https://mcp.datocms.com';
// registerClient   -> POST ${MCP_BASE_URL}/register
// authorize        ->      ${MCP_BASE_URL}/authorize
// token / revoke   -> POST ${MCP_BASE_URL}/token, /revoke

The MCP server now advertises a separate authorization server:

$ curl https://mcp.datocms.com/.well-known/oauth-protected-resource
{"resource":"https://mcp.datocms.com/","authorization_servers":["https://oauth.datocms.com"], ...}

$ curl https://oauth.datocms.com/.well-known/oauth-authorization-server
{"issuer":"https://oauth.datocms.com",
 "authorization_endpoint":"https://oauth.datocms.com/oauth/authorize",
 "token_endpoint":"https://oauth.datocms.com/oauth/token",
 "registration_endpoint":"https://oauth.datocms.com/oauth/register",
 "revocation_endpoint":"https://oauth.datocms.com/oauth/revoke", ...}

The legacy registration route rejects every request, regardless of body:

$ curl -X POST https://mcp.datocms.com/register -H 'Content-Type: application/json' -d '{}'
HTTP 401
{"error":"invalid_client","error_description":"Your DatoCMS login is out of date. Reconnect DatoCMS to fix it. ..."}

$ curl -X POST https://oauth.datocms.com/oauth/register -H 'Content-Type: application/json' -d '{}'
HTTP 400
{"error":"invalid_redirect_uri","error_description":"redirect_uris must be a non-empty array"}

The new endpoints send Access-Control-Allow-Origin: *, so the plugin can keep calling them from the browser. A DCR request with the plugin's exact payload succeeds on oauth.datocms.com/oauth/register, and /oauth/authorize with resource=https://mcp.datocms.com redirects to /session/new as expected.

Proposed fix

Point register/authorize/token/revoke at https://oauth.datocms.com/oauth/*, keep resource=https://mcp.datocms.com, and bump OAUTH_CLIENT_REGISTRATION_VERSION so client IDs cached from the legacy endpoint are replaced. PR incoming.

A longer-term option is to discover these endpoints from the .well-known metadata so future moves don't break the plugin.