account/loginStart

Experimental

Starts a host-owned login flow: the RFC 8628 device-code flow (result carries the verification URL and user code for native rendering) or the apiKey type (stores the carried key; completes synchronously). Supersedes a pending flow.

Parameters

Type: AccountLoginStartParams

account/loginStart params: exactly {type, apiKey?}. apiKey is required non-empty for [AccountLoginType::ApiKey] and forbidden for [AccountLoginType::DeviceCode]; both violations are invalid-params errors, enforced by the handler so the error never echoes the raw params. Debug is hand-written: the derive would print the raw key bytes into any {:?} context (a tracing line, an error, a test assert), the exact leak the protocol forbids — the McpOAuthRecordV1 posture.

Field	Type	Stability	Presence	Description
apiKey	string	Experimental	optional	The API key to store (the apiKey type only). The ONLY secret-bearing member of the account surface: every log sink carries [ACCOUNT_LOGIN_API_KEY_REDACTED] in its place.
type	AccountLoginType	Experimental	required	Which flow to run.

Source

schema/msp/experimental/msp.schema.json#/methods/account~2FloginStart

{
  "description": "Starts a host-owned login flow: the RFC 8628 device-code flow (result carries the verification URL and user code for native rendering) or the apiKey type (stores the carried key; completes synchronously). Supersedes a pending flow.",
  "params": {
    "$ref": "#/$defs/AccountLoginStartParams"
  },
  "result": {
    "$ref": "#/$defs/AccountLoginStartResult"
  },
  "x-msp-descriptor": "account/loginStart",
  "x-msp-stability": "experimental"
}