Ohvii for developers

Quickstart

You need an Ohvii buyer account and an AI host that supports remote MCP over Streamable HTTP with OAuth. Use the platform guide for your host.

1. Add the MCP server

https://ohvii.com/api/mcp

Use your host’s native OAuth connection flow. The service returns a Bearer challenge when an unauthenticated request needs authorization.

2. Sign in and choose access

Open Ohvii’s consent screen through the host. Start a read-only connection with workspace:read; add research:read and documents:read when needed. Request write and confirmation permissions only for the workflows the buyer wants.

3. Discover and make a first read

Let your MCP client negotiate the protocol, load the current server instructions and discover tools. After authorization, get_account reads the connected account with no input fields.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_account",
    "arguments": {}
  }
}

Send this through an authenticated MCP client. Keep credentials in the host’s connection store. Never ask a buyer to paste a password or bearer token into chat.

A successful response identifies the authorized account. An authorization failure is a setup issue to resolve before attempting a write. Read the full input and output contract for the response fields.

See a complete request and response →

Authentication

Ohvii uses authorization-code OAuth with S256 PKCE for public clients, exact redirect binding, scoped access tokens and rotating refresh tokens. The buyer signs in and approves the requested access in Ohvii.

Authorization server
https://ohvii.com/.well-known/oauth-authorization-server

Protected resource
https://ohvii.com/.well-known/oauth-protected-resource/api/mcp

Resource and audience
https://ohvii.com/api/mcp

1. Read protected-resource metadata and the advertised authorization-server metadata. Use the returned authorization, token, registration and revocation endpoints.
2. Identify the client using a supported Client ID Metadata Document, dynamic registration or an agreed registration. Follow the server’s advertised capabilities and the host’s exact redirect URI.
3. Use a fresh PKCE challenge and state. Include the exact resource above in authorization, code exchange and refresh requests. Public clients use token endpoint authentication none.
4. Validate the authorization response and exchange the code. Send the access token only in the Authorization header.
5. Store a rotated refresh token atomically and serialize refresh attempts per connection. A reused refresh token can revoke the grant.

When an access token expires, use the valid refresh token to renew it. If refresh returns invalid_grant, or the refresh token or grant is expired or revoked, reconnect through consent. Do not repeatedly replay a rejected refresh token. Buyers can remove access in Connected agents. Additional scopes require consent; an existing token is not permission to expand access.

Browser origins are checked separately from OAuth. If your integration calls the server from a browser, contact support about its required origin. A token does not permit arbitrary cross-origin calls.

Reference: MCP authorization specification ↗.

Permissions

The following permissions come from Ohvii’s active scope definitions. Each tool’s reference lists its required scopes. Account ownership, current revisions and approval controls are enforced in addition to OAuth.

The full catalog remains discoverable throughout a purchase. Discovery does not grant access: invocation checks the buyer’s actual permissions. For hosts with tool search, defer loading definitions while retaining access to the complete catalog.

Workflows and approvals

A request to make an offer starts preparation. It does not sign documents or authorize delivery. Preserve both the host’s permission controls and Ohvii’s buyer decisions.

When something changes

If terms, recipients, content or attachments change, re-read the record and prepare a new action. Old approval does not carry over. After an uncertain result or timeout, check authoritative state before retrying, especially for sends and consequential changes.

Example conversations

• “I found this listing. Help me understand the property and comparable sales.” The result is grounded research, with uncertainty identified.
• “Help me prepare an offer using the terms I choose.” The result is a saved draft, followed by its own review, signing and delivery steps.
• “What needs my attention on this purchase?” The result comes from current transaction records and deadlines.

Inline views and secure handoffs

Hosts that support MCP Apps can render Ohvii’s registered buyer views. Use negotiated capabilities and discover the current resources. Otherwise, present typed tool results and the focused handoff URL.

After a browser action is saved, tell the buyer to return to their AI and reply so it can check the saved result. Keep draft, review, signature, delivery and receipt states distinct.

Platforms

Use the same Ohvii account and MCP endpoint across compatible hosts. Choose your platform for setup instructions and current availability.

Setup guidance reviewed October 5, 2026.

Errors and limits

Tool failures return isError: true with JSON text containing error.code and error.message. An HTTP success response alone does not mean the operation succeeded.

Invocation limits apply to the connection, buyer, OAuth client and tool. Calls consume weighted units listed in the tool reference; expensive operations can cost more than simple reads. Domain-specific limits may also apply.

Source defaults use 15-minute windows: 600 units per grant, 1,200 per buyer, 100,000 per OAuth client and 160 per grant/tool pair. These are configurable defaults, not guaranteed production quotas.

Rate-limit metadata includes ohvii/retryAfterSeconds and ohvii/rateLimitScope. Deployment settings determine the active budgets. Avoid blind retries, and preserve any mutation identifier for the same operation where the tool supports it.

Data and privacy

Each tool declares the data classes it can return, including buyer profile, property, offer, document, contact and communication data. Request only the data needed for the buyer’s task and show the exact recipient before approved external delivery.

The connected AI provider receives the authorized tool results used in its conversation. Ohvii uses service providers to operate the product, including storage, document processing and messaging, as described in the Privacy Policy.

Disconnecting and deleting

Revocation stops future access through that grant. It does not delete data already received by an AI provider. Buyers manage that provider’s copies with the provider.

Account deletion removes the buyer’s profile, workspaces and uploaded files under Ohvii’s policy. Limited security and audit records may remain. Executed signing evidence is retained for five years from signing under Ohvii’s evidence policy, subject to legal holds or a longer legally required period. Consult the current policy for the complete retention terms.

Keep credentials, signatures and private transaction content out of diagnostics and public examples. For review demonstrations, use a dedicated synthetic account, visibly nonbinding QA documents and controlled recipients.

Versions and support

This reference is generated from the application’s tool contracts. It covers the standard and buyer UI v2 configurations; use authenticated discovery to determine the active surface on your connection.

Reference fingerprint: 00e5441a095c7e20. Source protocol versions: 2026-07-28 2025-11-25 2025-06-18 2025-03-26 2024-11-05 2024-10-07 .

The fingerprint identifies these contracts, including schemas and server instructions. It does not establish directory approval or native-host acceptance. The full catalog contains the complete fingerprint and configuration details.

See the running release, changelog and migration policy →

Get help

Contact info@ohvii.com for integration support or to report a security concern. Include the host, error code, reference fingerprint and a redacted description. Never send access tokens, passwords or private transaction documents.

Ohvii LLC · California, United States