How sign-in works
OAuth 2.1 with mandatory PKCE. Any standard OAuth library connects with no custom code, and every AI tool that speaks MCP does the whole dance automatically. There are two ways in: OAuth (ChatGPT, Claude Desktop, claude.ai, and any MCP tool) and a session token minted by the setup file (CLI tools). The legacy X-API-Key header no longer signs you in.
The short version
Point your tool at the address below and approve the sign-in page. That is the whole setup — no key to copy, nothing to paste into a config file.
claude mcp add --transport http optimiseres-ads https://mcp.optimiseres.com/mcp
The nine steps underneath
| # | Step | Endpoint | How often |
|---|---|---|---|
| 1 | Tool hits the MCP endpoint, gets a 401 pointing at auth | POST /mcp | Once per tool |
| 2 | Discovers which auth server protects this resource (RFC 9728) | GET /.well-known/oauth-protected-resource | Once per tool |
| 3 | Reads every endpoint, scope and capability (RFC 8414) | GET /.well-known/oauth-authorization-server | Once per tool |
| 4 | Registers itself, gets a client_id (RFC 7591) | POST /auth/register | Once per tool |
| 5 | Generates a PKCE verifier + S256 challenge, client-side | — | Every login |
| 6 | Opens the browser — you sign in and hit Approve | GET /auth/authorize | Once per person |
| 7 | Trades the one-time code for access + refresh tokens | POST /auth/token | Once per person |
| 8 | Calls MCP tools with the Bearer token — they run as you | POST /mcp | Every request |
| 9 | Refreshes the access token; the refresh token rotates | POST /auth/token | Every ~1h |
Endpoints
| Purpose | Endpoint |
|---|---|
| Resource metadata | https://mcp.optimiseres.com/.well-known/oauth-protected-resource |
| Server metadata | https://mcp.optimiseres.com/auth/.well-known/oauth-authorization-server |
| Public signing keys | https://mcp.optimiseres.com/auth/.well-known/jwks.json |
| Register an app | POST https://mcp.optimiseres.com/auth/register |
| Authorize | GET https://mcp.optimiseres.com/auth/authorize |
| Token / refresh | POST https://mcp.optimiseres.com/auth/token |
| MCP endpoint | https://mcp.optimiseres.com/mcp |
The rules we enforce
- PKCE S256 is mandatory. No plain challenges, no flow without one.
- Authorization codes last 60 seconds and are single use.
- Access tokens last 1 hour, signed RS256, verifiable from the JWKS endpoint.
- Refresh tokens last 30 days and rotate. Using one kills it and returns a new one, so a stolen token cannot be replayed.
- Revoking is instant. Every token issued before the revoke moment dies at once, even though a JWT is normally stateless.
- Scopes: mcp:tools, mcp:read, offline_access
The session-token path (CLI setup file)
The downloadable setup file signs you in with your password and stores a session token for Claude Code, Codex, Gemini and OpenCode. It expires on the admin sign-out timer — when that happens, just run the file again. If you need a session that never times out (for example for scheduled jobs), request no-logout from Session & login; an admin approves it per person. Details on Sessions & limits.