Authentication (OAuth)

This page covers how an assistant proves it is allowed to reach your library on the cloud connection. The local desktop connection does not use this; it runs on your own machine and needs no sign-in.

The short version

The cloud connection uses OAuth 2.1. When you add Avlok as a connector in an assistant, you are sent to sign in with your Avlok account and approve the connection. The assistant receives a token, never your password.

The flow

When you connect a web assistant to Avlok:

1. The assistant opens Avlok’s authorization page.
2. You sign in with your Avlok account and approve the connection.
3. Avlok issues an access token to the assistant.
4. The assistant includes that token on each request to the Avlok cloud server.

This is the standard authorization-code flow with PKCE, the modern OAuth pattern for app-to-service authorization. You can revoke access at any time by removing the connector in your assistant, or by turning off Cloud AI Access in Avlok.

For clients that cannot run an OAuth flow, Avlok can also generate a token directly: use the Generate MCP token button in the Cloud AI Access settings and paste the token into your client. You can revoke any of these tokens from the same place.

Note

Tokens are scoped to your account and to the folders you have shared through Cloud AI Access. A connected assistant can reach only those folders, never folders you left out or marked private.

What the token can do

The token grants read-only access to the tools documented in the Tool reference, scoped to your shared folders. It cannot change your account, your billing, or your library. It cannot reach folders outside your Cloud AI Access selection.

Revoking access

You have two independent ways to cut a connection:

• In the assistant: remove the Avlok connector. That assistant can no longer call Avlok.
• In Avlok: turn off Cloud AI Access in Settings → AI Integration. This cuts the cloud connection for every assistant at once, and your cloud data is deleted after 14 days.

Security notes

Tokens are never stored in plaintext on our side: long-lived tokens are kept only as hashes, and short-lived access tokens are not stored at all. All requests are over an encrypted connection. For how your photo data is handled across the connection, see How Avlok handles your data.