> ## Documentation Index > Fetch the complete documentation index at: https://docs.guidinghand.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start an OAuth sign-in for an MCP server > Connects an MCP server that signs in with OAuth (the MCP authorization spec, 2025-06-18): Eager finds its authorization server (protected-resource and authorization-server metadata), registers itself as a client when the server allows it, and returns the provider's sign-in page (PKCE). The person opens it, signs in and is sent back to `/v1/mcp_oauth/callback`, which finishes the sign-in. The console's **Connect with OAuth** does all of this. Needs a signed-in person with the admin role (API keys get a 403): only the person who started a sign-in can finish it. Then save the server with `auth: { "secret_id": … }`. Tokens are kept encrypted, renewed before they expire, and never returned. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/mcp_oauth/start openapi: 3.1.0 info: title: Eager API version: 1.0.0 description: >- Train AI agents like new hires: hand an agent your files and coach it, and it writes its own procedures and works in any software, even without an API. Talk to your agents one message at a time (POST /v1/agents/{agent_id}/responses): they answer from their files, procedures and your HTTP tools, and run tasks on their own cloud browser or your linked computers when an answer needs a website or a desktop app. Manage agents (versioned: save a draft, publish it), their procedures, browser and computers; follow conversations and tasks, answer approvals, and fetch history and recordings. Run tasks yourself on a session: a customer’s computer through an invite link, or a cloud browser. Test agents with evals: chat, browser and desktop test cases, run several times against your agents and judged on the answer. Every change is in the org’s audit log. servers: - url: https://guidinghand.ai description: Production - url: https://dev.guidinghand.ai description: Development (Stripe test mode) security: - bearerAuth: [] tags: - name: Agents - name: Agent files - name: Agent tools - name: Agent folders - name: Computers description: >- Computers your org links with the Eager app, and pools of them, for agents’ desktop tasks. Attach them to an agent in its `resources.computers`. - name: Phone numbers description: >- Bring your own Twilio numbers: connect the account, add its numbers, and pick the agent that answers each. Calls are answered by the agent's published version. - name: Sessions - name: Tasks - name: Webhooks - name: Audit log - name: Test cases - name: Test sets - name: Test runs - name: Start states - name: Runners - name: Responses description: >- Talk to an agent: each call is one turn of a conversation. The agent answers with its files, procedures and tools (and, with Run code, its own sandbox), asks for details with forms, and runs browser and desktop tasks when an answer needs a website or a desktop app. - name: Conversations description: >- The history of each conversation: messages, tool calls and the tasks the agent started, in order. - name: Uploads description: >- Files for conversations: attach them to a message, and download what the agent’s code made. Kept as long as their conversation. - name: Procedures description: >- An agent’s playbooks: when to use each and its steps. The agent finds and follows them; ones it writes from a first run are marked written_by: agent. - name: Categories description: The kinds of request an org’s procedures and test cases are sorted into. - name: Escalations description: >- What needs your team: an approval only the team can give or a question only it can answer, in a real conversation; a procedure run that failed; and one that worked another way, with the procedure rewritten to match (a proposed change). Test chats never escalate; evals do, without webhooks. - name: Schedules description: >- Run an agent’s procedure on a cron expression, in a time zone, with the inputs it needs. Each run is a conversation of its own with nobody in it (`channel` `schedule` in its variables): the procedure’s steps without AI run outright when it has them, else the model follows it to its end. Its record says how it ended, what the agent said last and what it cost; the team hears by webhook (`schedule.run_completed`, `schedule.run_failed`), email and Slack or Teams, as the schedule says. paths: /v1/mcp_oauth/start: post: tags: - Agent tools summary: Start an OAuth sign-in for an MCP server description: >- Connects an MCP server that signs in with OAuth (the MCP authorization spec, 2025-06-18): Eager finds its authorization server (protected-resource and authorization-server metadata), registers itself as a client when the server allows it, and returns the provider's sign-in page (PKCE). The person opens it, signs in and is sent back to `/v1/mcp_oauth/callback`, which finishes the sign-in. The console's **Connect with OAuth** does all of this. Needs a signed-in person with the admin role (API keys get a 403): only the person who started a sign-in can finish it. Then save the server with `auth: { "secret_id": … }`. Tokens are kept encrypted, renewed before they expire, and never returned. operationId: startMcpOauth requestBody: required: true content: application/json: schema: type: object required: - url properties: url: type: string format: uri example: https://mcp.linear.app/mcp description: The MCP server's Streamable HTTP address. secret_id: type: string description: >- An OAuth sign-in to reconnect (it keeps its id, so every agent version that uses it works again). client_id: type: string description: >- For a server that doesn't let apps register themselves (a 400 with `code: mcp_oauth_client_needed` and the `redirect_uri` to register): the client you registered with it. client_secret: type: string description: That client's secret, if it has one. Kept encrypted. name: type: string maxLength: 80 description: >- For a new sign-in: how the org's connections list it, like "Notion". Left out: the library entry's name, else the server's host. connector: type: string example: notion description: >- For a new sign-in: the library entry it's for (`GET /v1/connectors`). responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/McpOauth' '400': $ref: '#/components/responses/E400' '401': $ref: '#/components/responses/E401' '403': $ref: '#/components/responses/E403' '404': $ref: '#/components/responses/E404' components: schemas: McpOauth: type: object description: 'An OAuth sign-in for an MCP server: its state, never its tokens.' properties: object: type: string enum: - mcp_oauth secret_id: type: string example: tsec_8Zp2kQ7wLm4x description: >- Put it in the server's `auth` (`{ "secret_id": … }`) to use this sign-in. url: type: string format: uri description: >- The MCP server it's for. It's only ever sent to this address's origin. status: type: string enum: - pending - connected - expired description: >- `pending`: not connected yet. `connected`: the agent can call the server. `expired`: the provider wouldn't renew it; reconnect it. pending: type: boolean description: >- A sign-in started (or a reconnect) waits for the person to finish it. scope: type: - string - 'null' description: The scopes it was granted (or asked for). connected_at: type: - string - 'null' format: date-time error: type: - string - 'null' description: Why the last attempt didn't connect, or why it expired. authorize_url: type: string format: uri description: >- Start only: the provider's sign-in page, to open in a popup for the person. Error: type: object required: - error properties: error: type: object required: - type - message properties: type: type: string enum: - invalid_request - authentication - payment_required - permission - not_found - conflict - rate_limit - server_error message: type: string code: type: string description: >- Why it was refused, when there’s more to say than the status. Starting a task or a chat reply: `insufficient_balance`, `auto_topup_limit_reached` or `card_needs_attention` (402: the balance is empty and auto top-up can’t add funds; add funds, raise the auto top-up limit, or update the card), `concurrency_limit` (429), `model_unavailable` (503: the agent’s `model` can’t run on this server; choose another). Deciding a conversation’s request: `already_decided` (409: someone decided or answered it first; see `decided_by`) or `not_pending` (409: its task has ended, so nothing would act on it). POST /v1/tasks/{task_id}/respond: `decide_in_conversation` (409: decide it in the task’s conversation; see `conversation_id`, `agent_id`, and `approval_id` or `question_id`). Deleting a start state that test cases use: `in_use` (409, with `test_case_ids`). test_case_ids: type: array items: type: string description: 'With `in_use`: the test cases that use the start state.' decided_by: description: 'With `already_decided`: who decided first.' allOf: - $ref: '#/components/schemas/Decider' conversation_id: type: string description: >- With `decide_in_conversation`: the conversation to decide it in (POST /v1/conversations/{conversation_id}/decisions). agent_id: type: - string - 'null' description: >- With `decide_in_conversation`: the task’s agent (null for a task run without one). approval_id: type: string description: 'With `decide_in_conversation`: the approval to decide.' question_id: type: string description: 'With `decide_in_conversation`: the question to answer.' Decider: type: object description: Who decided a request, or answered a question. required: - type properties: type: type: string enum: - person - team - auto - refused - timeout - operator - moved_on description: >- `person`: the person in the chat (in the Eager app, or a visitor to your website’s widget), when the agent lets them (`customer_approvals`, `customer_answers`) and the request isn’t for your team only. `team`: a member in the console (`email`) or an API key (`key_id`). `auto`: the agent’s guardrails approve without asking (`mode: auto`). `refused`: its guardrails refuse (`mode: unattended`). `timeout`: nobody decided within its `approval_timeout_minutes`. `operator`: an eval case’s operator. `moved_on`: the person sent a new message instead, so it was declined. email: type: string description: '`team`: the member who decided.' key_id: type: string description: '`team`: the API key that decided.' responses: E400: description: The request is invalid. content: application/json: schema: $ref: '#/components/schemas/Error' E401: description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/Error' E403: description: Your role can’t do this. content: application/json: schema: $ref: '#/components/schemas/Error' E404: description: Not found in this org. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer description: An org API key (`gh_live_…`) from Settings → API keys in the console. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.