Delegated access
Choose the OAuth application and WebMoney grants: wallets, actions, allowed applications and IPv4 rules. Issuing or expanding sensitive permissions requires confirmed sign-in (2FA). The client then operates within delegated access; Gateway checks a valid access token, scopes and applicable grants. Gateway writes do not require repeating 2FA every 15 or 60 minutes. Grant restrictions, wallet selection and argument checks still apply. A third-party application can act on your behalf within those permissions.
Access tokens and refresh
An access token expires. A client supporting refresh can renew it without another interactive sign-in while Id policy, the refresh token and granted permissions allow it. Refresh neither expands permissions nor resets the original 2FA time. Successful requests do not establish a maximum lifetime in days. Refresh idle/absolute limits and server revocation behavior depend on Id policy; unknown limits are not promised as unlimited. A rejected refresh may require sign-in again.
The separate one-hour account session
The website uses a 60-minute session with a fixed deadline; activity and refresh do not extend it. This is separate from the MCP client's OAuth connection. Website logout does not prove immediate revocation of all client tokens.
Security requires confirmed sign-in when changing grants. In the current mode, Security and W3S SQL agree on confirmation age of up to 3600 seconds. Refresh preserves the original auth_time; the account session does not set the delegated client's maximum lifetime.
Restrict or revoke access
Review wallet/message grants, allowed applications and IPv4 in your account. Reduce or revoke unnecessary access. OAuth consent and internal grants are separate layers; manage the relevant layer. Local client logout alone does not prove server revocation.
Immediate termination of every issued token is not promised: enforcement and caching depend on the layer. Never share tokens, secrets, cookies or HAR files. A public client_id identifies an application and is not a secret.
Confirming a specific action
confirm_real_operation is a client argument, not user 2FA or an independent confirmation screen. Verify exact financial parameters before calling. Delegating permissions does not confirm a particular payment.
ChatGPT/Claude integrations are in progress. Future profile restrictions must be enforced by the server on tools/call; hiding tools or removing only wm.transfers.create is insufficient because wm.invoices.manage also permits changes.
Technical reference · Connect · FAQ