curl --request GET \
--url https://guidinghand.ai/v1/mcp_oauth/{secret_id} \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://guidinghand.ai/v1/mcp_oauth/{secret_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://guidinghand.ai/v1/mcp_oauth/{secret_id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"object": "mcp_oauth",
"secret_id": "tsec_8Zp2kQ7wLm4x",
"url": "<string>",
"status": "pending",
"pending": true,
"scope": "<string>",
"connected_at": "2023-11-07T05:31:56Z",
"error": "<string>",
"authorize_url": "<string>"
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"code": "<string>",
"test_case_ids": [
"<string>"
],
"decided_by": {
"type": "person",
"email": "<string>",
"key_id": "<string>"
},
"conversation_id": "<string>",
"agent_id": "<string>",
"approval_id": "<string>",
"question_id": "<string>"
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"code": "<string>",
"test_case_ids": [
"<string>"
],
"decided_by": {
"type": "person",
"email": "<string>",
"key_id": "<string>"
},
"conversation_id": "<string>",
"agent_id": "<string>",
"approval_id": "<string>",
"question_id": "<string>"
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"code": "<string>",
"test_case_ids": [
"<string>"
],
"decided_by": {
"type": "person",
"email": "<string>",
"key_id": "<string>"
},
"conversation_id": "<string>",
"agent_id": "<string>",
"approval_id": "<string>",
"question_id": "<string>"
}
}Get an OAuth sign-in
Whether an MCP server’s OAuth sign-in is connected, waiting for the person, or expired. Never its tokens. Needs the admin role or an API key.
curl --request GET \
--url https://guidinghand.ai/v1/mcp_oauth/{secret_id} \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://guidinghand.ai/v1/mcp_oauth/{secret_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://guidinghand.ai/v1/mcp_oauth/{secret_id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"object": "mcp_oauth",
"secret_id": "tsec_8Zp2kQ7wLm4x",
"url": "<string>",
"status": "pending",
"pending": true,
"scope": "<string>",
"connected_at": "2023-11-07T05:31:56Z",
"error": "<string>",
"authorize_url": "<string>"
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"code": "<string>",
"test_case_ids": [
"<string>"
],
"decided_by": {
"type": "person",
"email": "<string>",
"key_id": "<string>"
},
"conversation_id": "<string>",
"agent_id": "<string>",
"approval_id": "<string>",
"question_id": "<string>"
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"code": "<string>",
"test_case_ids": [
"<string>"
],
"decided_by": {
"type": "person",
"email": "<string>",
"key_id": "<string>"
},
"conversation_id": "<string>",
"agent_id": "<string>",
"approval_id": "<string>",
"question_id": "<string>"
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"code": "<string>",
"test_case_ids": [
"<string>"
],
"decided_by": {
"type": "person",
"email": "<string>",
"key_id": "<string>"
},
"conversation_id": "<string>",
"agent_id": "<string>",
"approval_id": "<string>",
"question_id": "<string>"
}
}Authorizations
An org API key (gh_live_…) from Settings → API keys in the console.
Path Parameters
Response
OK
An OAuth sign-in for an MCP server: its state, never its tokens.
mcp_oauth Put it in the server's auth ({ "secret_id": … }) to use this sign-in.
"tsec_8Zp2kQ7wLm4x"
The MCP server it's for. It's only ever sent to this address's origin.
pending: not connected yet. connected: the agent can call the server. expired: the provider wouldn't renew it; reconnect it.
pending, connected, expired A sign-in started (or a reconnect) waits for the person to finish it.
The scopes it was granted (or asked for).
Why the last attempt didn't connect, or why it expired.
Start only: the provider's sign-in page, to open in a popup for the person.