OAuth Reference
Full OAuth 2.1 endpoint reference for MR Labs MCP. Used by ChatGPT and other MCP clients for automatic authentication.
Endpoints
| Endpoint | URL | Method |
|---|---|---|
| MCP Endpoint | /mcp | POST |
| Authorization | /oauth/authorize (frontend) | GET |
| Token Exchange | /api/v1/oauth/token | POST |
| Client Registration | /api/v1/oauth/register | POST |
| Auth Server Metadata | /.well-known/oauth-authorization-server | GET |
| Protected Resource | /.well-known/oauth-protected-resource | GET |
Authorization Server Metadata
The /.well-known/oauth-authorization-server endpoint returns:
| Field | Value |
|---|---|
| issuer | Your ISSUER_URL |
| authorization_endpoint | {APP_URL}/oauth/authorize |
| token_endpoint | {ISSUER_URL}/api/v1/oauth/token |
| registration_endpoint | {ISSUER_URL}/api/v1/oauth/register |
| response_types_supported | code |
| grant_types_supported | authorization_code |
| token_endpoint_auth_methods_supported | client_secret_post, none |
| code_challenge_methods_supported | S256 |
| scopes_supported | mcp |
Client Registration (RFC 7591)
Clients register themselves automatically via POST /api/v1/oauth/register. The request body includes:
| Field | Type | Description |
|---|---|---|
| client_name | string | Display name of the client |
| redirect_uris | string[] | Allowed callback URLs |
| grant_types | string[] | authorization_code |
| response_types | string[] | code |
| token_endpoint_auth_method | string | none (public client) or client_secret_post |
| scope | string | Requested scopes, e.g. mcp |
The response returns client_id, client_secret (if applicable), and the registered metadata.
Authorization Flow
- Client redirects user to
/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256&scope=mcp&state=... - User logs in and approves the connection on the MR Labs authorization page
- MR Labs redirects back to
redirect_uriwithcodeandstate - Client exchanges the code at
POST /api/v1/oauth/tokenwithgrant_type=authorization_code,code,code_verifier, andredirect_uri - Token endpoint returns a personal access token that the client uses as
Authorization: Bearer ...on all MCP requests
PKCE
All authorization requests must use PKCE (Proof Key for Code Exchange) with the S256 method. The client generates a code_verifier and derives code_challenge = BASE64URL(SHA256(code_verifier)).
Public Clients
Clients with token_endpoint_auth_method: "none" do not send a client secret during token exchange. This is the default for ChatGPT and other browser-based MCP clients.