# DeskCafés

Find claimed, control-verified venues for working with a laptop.

- MCP: https://deskcafes.com/mcp (Streamable HTTP, stateless; OAuth)
- API: https://deskcafes.com/api/external/v1
- OpenAPI: https://deskcafes.com/api/openapi.json
- Documentation: https://deskcafes.com/api

Public discovery is anonymous and bounded. Account operations require user-authorized OAuth and current roles. Never ask for passwords, authentication codes, TOTP seeds or recovery codes in chat or a tool form. Use protected DeskCafés links for those steps. Do not infer completion from a returned link or from confirmed: true. A user prepares a visit code; authorized venue staff validate it. Codes expire within 90 seconds. No reservations, seat guarantees, platform payments or paid-state ledger exist.

Connection access is enabled by default after authorization. Only the user can disable access or revoke connections in their web profile. Tokens must match the API or MCP resource audience. Retain request IDs when retrying writes; preserve revisions and resolve conflicts deliberately. Never fetch arbitrary media URLs or expose private Overture candidates publicly.

Native Codex CLI OAuth requires a client that preserves the callback issuer (0.147.0 or later; 0.160.0 tested). Codex 0.145.0 and 0.146.0 discard iss and report a missing issuer even when the browser received it and says Authentication complete. Check the executable used by the requesting host before repeating authorization. On Homebrew use brew update, then brew upgrade --cask codex, and verify codex --version. Reuse the existing MCP server configuration and run codex mcp login deskcafes after updating. Browser approval is pending until the application exchanges credentials and successfully uses the account. Never paste callback URLs or codes into chat.