Connect your AI client

Every gateway has one MCP endpoint, <portal URL>/mcp/<gateway slug>, for example https://mcp.example.com/mcp/support. Open MCP Portal serves it over Streamable HTTP. You find the URL, with ready-made snippets, under My gateways › the gateway › Connect, or on the gateway's Overview tab.

OAuth sign-in or an API keyCopy Anchor Link

All three see only what the caller may use on that gateway, checked again on every request. Prefer OAuth for yourself: there's no secret to store, and the connection is limited to one gateway. The Connect card's snippets use OAuth; turn on Use an API key instead for the header variants.

What happens when you sign inCopy Anchor Link

Add the gateway's URL to your client without any header. The first time the client talks to the gateway, the portal answers 401 with a pointer to its sign-in metadata. The client then opens your browser:

1. You sign in with your company account, if you aren't signed in to the portal already.
2. The consent page names the app, the host that vouches for it, the gateway it wants and where your browser goes back to. Choose Allow (or Deny).
3. The browser returns to the app, which now has tokens and refreshes them by itself.

Consent is remembered per app and gateway: connecting the same app to another gateway asks again. Apps your platform admins trust (Claude, Claude Code and VS Code out of the box) skip the consent page, but you still sign in.

What a connected app can do:

• It acts as you, on that gateway only. Its token is refused by every other gateway and by the management API.
• Every request checks your account (suspended people are refused), your current access to the gateway (removing you from the team or the grant stops it at the next request) and that the connection still exists.
• Access tokens last an hour. The app refreshes them; each refresh token lasts 30 days and is replaced on every use, so an app used at least monthly stays connected. If a refresh token is used twice (a sign of theft), the connection is revoked and you sign in again.
• You can disconnect it at any time under Account › Connected apps.

Claude CodeCopy Anchor Link

claude mcp add --transport http support https://mcp.example.com/mcp/support

VS CodeCopy Anchor Link

Add this to .vscode/mcp.json in your workspace (or your user configuration).

{
  "servers": {
    "support": { "type": "http", "url": "https://mcp.example.com/mcp/support" }
  }
}

CursorCopy Anchor Link

Add this to ~/.cursor/mcp.json (or .cursor/mcp.json in a project), then reload Cursor's MCP servers.

{
  "mcpServers": {
    "support": { "url": "https://mcp.example.com/mcp/support" }
  }
}

piCopy Anchor Link

The portal's Connect card has no pi tab, but pi speaks Streamable HTTP and OAuth, so the gateway's URL is all it needs.

pi mcp add support --url https://mcp.example.com/mcp/support
pi mcp login support

{
  "mcpServers": {
    "support": {
      "url": "https://mcp.example.com/mcp/support",
      "oauth": { "clientRegistration": "cimd" }
    }
  }
}

Claude (claude.ai and Claude Desktop)Copy Anchor Link

Add a custom connector with the gateway's URL. claude.ai connects from the internet, so the portal must be reachable from the internet for it.

Other MCP clientsCopy Anchor Link

Any client that supports MCP over Streamable HTTP works:

• With OAuth: give it the URL with no header. The portal follows the MCP authorization specification: protected-resource metadata at /.well-known/oauth-protected-resource/mcp/<slug>, authorization server metadata at /.well-known/oauth-authorization-server, authorization code with PKCE (S256 only), and the gateway's URL as the resource. Clients identify themselves with a Client ID Metadata Document (preferred) or by registering (Dynamic Client Registration). Redirect URIs must be https, or http on a loopback address. See OAuth endpoints.
• With a key: send Authorization: Bearer <key> on every request.

To check a URL and key from a terminal:

curl -X POST https://mcp.example.com/mcp/support \
  -H "Authorization: Bearer <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Apps without a metadata documentCopy Anchor Link

Clients identify themselves either with a Client ID Metadata Document (an https URL their maker publishes; the consent page shows "From <host>") or, for older clients, by registering themselves. Self-registered apps are marked Unverified on the consent page: anyone can register any name, so allow one only if you just connected it yourself, and check the host the page says your answer goes to. They are never on the trusted list, a registration unused for 30 days expires (the app registers again), and call records show their calls as "via <name> (unverified)".

If the browser shows Can't connect this app, the app's request was refused before anything was shared: an unknown app, a redirect address the app never registered, or a metadata document the portal can't fetch. Errors after that (no PKCE, a URL that isn't one of your gateways, a gateway you can't use) go back to the app, which usually shows them.

NextCopy Anchor Link

• Tools that need your account on another service: Connecting accounts.
• Something doesn't work: Troubleshooting.
• Calling tools from your own code: Use from your own agents.