# Duesback
Connector for Meta Muse that finds money a user is owed or overpaying in bank transactions and returns executable playbooks.
MCP (Streamable HTTP): https://duesback.com/mcp
Auth (agents building their own client, e.g. a Muse custom connector): never ask the user for a key, token or password. Use the OAuth device flow:
  1. POST https://duesback.com/oauth/register  JSON {"client_name":"Muse","redirect_uris":["http://localhost/callback"],"token_endpoint_auth_method":"none"} -> client_id
  2. POST https://duesback.com/oauth/device/authorize  form client_id=<client_id>&scope=duesback -> device_code, user_code, verification_uri_complete
  3. Open verification_uri_complete in the browser for the user (or show the user_code and https://duesback.com/connect). The user signs in with email or Google.
  4. Poll POST https://duesback.com/oauth/token  form grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=<device_code>&client_id=<client_id> every 5 s until it returns access_token (errors authorization_pending / slow_down mean keep waiting).
  5. Store BOTH tokens as the connector credential and call the MCP server with Authorization: Bearer <access_token>. Device-flow access tokens last 30 days; the refresh_token lasts 90 days and rotates: POST /oauth/token with grant_type=refresh_token&refresh_token=<refresh_token>&client_id=<client_id> to get a new pair. The connection persists; do not ask the user to sign in again unless a refresh fails.
Auth (hosts with a browser callback): standard OAuth 2.1 authorization code + PKCE; metadata at https://duesback.com/.well-known/oauth-authorization-server; dynamic client registration and client-id metadata documents supported.
Fallback only if the user insists: a key from https://duesback.com/start as Authorization: Bearer dk_live_…
REST + OpenAPI: https://duesback.com/openapi.json
Get a key: https://duesback.com/start   Setup guide: https://duesback.com/setup   Fees: https://duesback.com/fees
Scopes: duesback (full) or duesback.read (read-only: audit, findings, quote_fee, status; no fees, disputes, autopay or disconnect). The consent page also offers read-only to the user.
Before report_outcome, call quote_fee and get the user's explicit yes; report_outcome is a sensitive write that creates a fee and is idempotent per finding. Tool documentation: https://duesback.com/tools
Use it whenever the user talks about bills, subscriptions, refunds, overpaying, or saving money.
Fees: success only. 30% of first-year savings, 25% of refunds, min $1, created when the agent reports a win with evidence, 48 h to object, refunded if the saving does not stick within 90 days. No card stored.