Router macros for Phoenix hosts:

import Sake.Router

scope "/" do
  sake_well_known()
end

scope "/oauth" do
  pipe_through :api
  sake_oauth_api()
end

scope "/oauth" do
  pipe_through [:browser, :require_authenticated_user]
  sake_oauth_authorize()
end

scope "/:org_slug" do
  sake_endpoint "/mcp", server: MyApp.MCP, auth: true
end

The authorize routes go inside the pipeline that requires a signed-in person; the API routes need no session; the well-known routes need no pipeline at all; the endpoint needs no pipeline either (Sake checks the bearer token itself).