feat: authenticate with OAuth DCR and PKCE

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- Sign in with OAuth 2.1 (dynamic client registration and PKCE) instead of a browser-issued API key. Tokens refresh automatically across hooks and the MCP proxy; `logout` revokes them. API keys from the environment, config or an existing credentials file keep working and take precedence.
+
 ## 1.2.3
 
 - Use the bundled official Supermemory 5.0.1 SDK for hosted REST profile, search and document capture, preserving existing namespace strings, metadata and incremental generation IDs.

README.md

@@ -18,6 +18,11 @@ Every host names the install path after itself — Cursor sets `CURSOR_PLUGIN_RO
 Claude Code and Grok set `CLAUDE_PLUGIN_ROOT`, Grok also sets `GROK_PLUGIN_ROOT` —
 so the command above finds the install itself and works from any directory.
 
+`login` signs in through OAuth in your browser (dynamic client registration with PKCE, callback on
+`127.0.0.1:19879`) and stores rotating tokens in `~/.supermemory-cursor/credentials.json`. An API key
+from `SUPERMEMORY_API_KEY` or config still takes precedence, and a previously saved API key keeps
+working until you run `login` again. `logout` revokes the refresh token and removes the credentials.
+
 ### Upgrade channels
 
 This repository's **1.2.3 plugin-panel/Git distribution** uses the hosted MCP proxy and SDK-backed v5 REST hooks. Existing plugin-panel installations can update in Cursor and reload the window; an isolated Git/local installation can replace its plugin directory with this version. Keep your existing global/project config, credentials and hook-state files. The update does not rewrite them or upload historical transcripts. Existing container-tag strings are used unchanged as v5 namespaces, with canonical and legacy reads retained.
@@ -85,7 +90,8 @@ run the `/supermemory-config` command.
 | `SUPERMEMORY_API_URL` | Override the Supermemory API base URL |
 | `SUPERMEMORY_BASE_URL` | API base URL fallback when `SUPERMEMORY_API_URL` is unset |
 | `SUPERMEMORY_API_VERSION` | Explicit `v5` or `legacy` REST contract; overrides config `apiVersion` |
-| `SUPERMEMORY_MCP_URL` | Independent hosted MCP proxy endpoint; REST version selection does not change it |
+| `SUPERMEMORY_MCP_URL` | Independent hosted MCP proxy endpoint and OAuth resource; REST version selection does not change it. Required for OAuth on a custom API URL that is not an `api.*` host |
+| `SUPERMEMORY_OAUTH_ISSUER` | OAuth issuer (default `<API URL>/api/auth`) |
 | `SUPERMEMORY_REPO_TAG` | Override the unified repository container tag |
 | `SUPERMEMORY_USER_TAG` | Legacy Cursor personal container to continue reading |
 | `SUPERMEMORY_PROJECT_TAG` | Legacy Cursor project container to continue reading |

commands/supermemory-logout.md

@@ -9,4 +9,4 @@ Run the following command to remove your Supermemory credentials:
 node "$(ls -d ~/.cursor/plugins/local/cursor-supermemory ~/.cursor/plugins/cache/*/cursor-supermemory/*/ 2>/dev/null | head -1)/dist/cli.js" logout
 ```
 
-Your credentials will be removed from ~/.supermemory-cursor/credentials.json. Your memories in Supermemory are not deleted.
+Your OAuth refresh token is revoked and your credentials are removed from ~/.supermemory-cursor/credentials.json. Your memories in Supermemory are not deleted.

commands/supermemory-setup.md

@@ -12,4 +12,4 @@ node "$(ls -d ~/.cursor/plugins/local/cursor-supermemory ~/.cursor/plugins/cache
 
 This opens your browser to connect your Supermemory account to Cursor. Once connected, the AI will have persistent memory across all your coding sessions.
 
-If the browser doesn't open automatically, visit: https://app.supermemory.ai/auth/connect?client=cursor
+If the browser doesn't open automatically, open the authorization URL the command prints.