Skip to main content
POST
Start an OAuth sign-in for an MCP server

Authorizations

Authorization
string
header
required

An org API key (gh_live_…) from Settings → API keys in the console.

Body

application/json
url
string<uri>
required

The MCP server's Streamable HTTP address.

Example:

"https://mcp.linear.app/mcp"

secret_id
string

An OAuth sign-in to reconnect (it keeps its id, so every agent version that uses it works again).

client_id
string

For a server that doesn't let apps register themselves (a 400 with code: mcp_oauth_client_needed and the redirect_uri to register): the client you registered with it.

client_secret
string

That client's secret, if it has one. Kept encrypted.

name
string

For a new sign-in: how the org's connections list it, like "Notion". Left out: the library entry's name, else the server's host.

Maximum string length: 80
connector
string

For a new sign-in: the library entry it's for (GET /v1/connectors).

Example:

"notion"

Response

OK

An OAuth sign-in for an MCP server: its state, never its tokens.

object
enum<string>
Available options:
mcp_oauth
secret_id
string

Put it in the server's auth ({ "secret_id": … }) to use this sign-in.

Example:

"tsec_8Zp2kQ7wLm4x"

url
string<uri>

The MCP server it's for. It's only ever sent to this address's origin.

status
enum<string>

pending: not connected yet. connected: the agent can call the server. expired: the provider wouldn't renew it; reconnect it.

Available options:
pending,
connected,
expired
pending
boolean

A sign-in started (or a reconnect) waits for the person to finish it.

scope
string | null

The scopes it was granted (or asked for).

connected_at
string<date-time> | null
error
string | null

Why the last attempt didn't connect, or why it expired.

authorize_url
string<uri>

Start only: the provider's sign-in page, to open in a popup for the person.