The MCP endpoint advertises protected-resource metadata. A compatible client discovers the authorization server, opens Tjati sign-in, and returns with a scoped installation.
https://api.tjati.com/.well-known/oauth-protected-resource/mcpRecovery
If a refresh token expires or access is revoked, remove the stale client connection and start OAuth again. Reauthorization creates fresh authority; it does not restore a revoked key.