Connecting accounts

Some tools act as you on another service: create a GitHub issue as you, search your Gmail, read your Google Drive. Others belong to an MCP server that is OAuth-protected itself, such as GitHub's hosted MCP server, where each person signs in to the server's own service. In both cases Open MCP Portal needs your account on that service once. It keeps the token, refreshes it, and sends it only to the server that needs it. Your AI client and its model never see it.

The first call: a link instead of a resultCopy Anchor Link

The first time you call such a tool, the call isn't forwarded. The portal answers with JSON-RPC error -32042 (URLElicitationRequiredError in the MCP specification) carrying a link:

github-tools__create_issue needs your GitHub account (repo). Open
https://mcp.example.com/connect/github?request=Zk3… to connect it, then try again.

Clients that support URL elicitation show the link as a prompt; others show the error message, which contains the link. Open it in your browser:

1. If you aren't signed in to the portal, you sign in first. The sign-in page says "A tool needs one of your accounts".
2. The confirm page shows who you're signed in as, the tool that asked, the gateway, the service (or the MCP server and its team), the account connected now, and each permission (scope) asked for, marked as already allowed or new. Nothing has been sent to the service yet.
3. Choose Continue to <service> (for an MCP server, Continue to sign in) and approve at the service. Or Cancel: nothing is connected.
4. The result page says whether it worked. Go back to your AI client and run the tool again.

The link works only for you (it isn't a sign-in link: it needs your own browser session with the portal), only once, and for 10 minutes. Opened by someone else, it shows "This link was made for someone else". Expired or used, it shows "This link expired": run the tool again for a new one. Calling the same tool again while a link is still valid returns the same link.

When the result page says something elseCopy Anchor Link

Connecting ahead of timeCopy Anchor Link

You don't have to wait for a tool to ask:

• My gateways › a gateway › Accounts it needs lists each service the gateway's tools need, with Connect buttons.
• Account › My connections › Connect an account connects a service with its default permissions.

My connectionsCopy Anchor Link

Account › My connections lists your connected accounts: the service (or MCP server, with an "MCP server" badge and its team), the account it is (such as your GitHub login), the permissions granted, the status, when it was last used and when the token expires. From there you can Connect, Reconnect and Disconnect.

• One connection per service. Connecting again asks for everything granted before plus anything new, so a new token never loses permissions.
• The portal refreshes tokens shortly before they expire. If a refresh is refused (for example you revoked the app at the service), the connection shows that it needs you to connect again, and the next call answers with a new link.
• Disconnect erases the tokens at once and, where the service supports it, revokes them there too.
• Leaving a team doesn't change your connections: they are yours. If you're suspended, they're kept but every request you make is refused.

Platform admins can see the metadata of anyone's connections (never the tokens) and disconnect them; auditors can see them.

MCP servers you sign in toCopy Anchor Link

For a server in OAuth mode, the link reads, for example, "github__get_me needs you to sign in to GitHub MCP (repo …)", and the confirm page names the server, its sign-in host (such as github.com) and each scope. Two more cases ask you again:

• the server stops accepting your token (it answers 401): the portal refreshes once and retries; if that fails, the next call answers -32042 with a new link;
• the server asks for more access (403 insufficient_scope) within the scopes its team had reviewed: the next call answers -32042 asking for them.

Anything else the server refuses comes back as -32010 with the reason.

Service accountsCopy Anchor Link

Service accounts can't use tools that act as a person: their calls answer -32010 with data.reason service_account. Those tools still appear in lists, marked "Service accounts can't use this" in team views.