MCP Gateway
ApiServer oauth

Initiate server OAuth flow

Start the OAuth authorization flow to connect the current user's external account to an MCP server. Uses PKCE and database-stored state for security.

POST
/api/v1/servers/{server_id}/oauth/authorize

Authorization

User API Key
AuthorizationBearer <token>

User API key (mgw_usr_live_* or mgw_usr_test_*)

In: header

Path Parameters

server_id*string
Formatuuid
access_token?|

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://loading/api/v1/servers/497f6eca-6276-4993-bfeb-53cbbbba6f08/oauth/authorize" \  -H "Content-Type: application/json" \  -d '{    "oauth_app_id": "bf295b67-8583-439b-af58-e5af4617dc04"  }'
{
  "authorization_url": "string",
  "state": "string",
  "expires_in": 600
}
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Cleanup expired OAuth states

Admin endpoint to clean up expired OAuth states. Typically called by a scheduled job. Requires admin privileges.

Handle server OAuth callback

Process the OAuth provider redirect after user authorization. Exchanges the code for tokens, encrypts them, and stores a user connection.