MCP OAuth

Overview

This authenticated operation converts the short-lived setup token returned by MCP connect into a browser authorization URL. It requires the same Tenant's dashboard JWT; an API key cannot approve the admin-session continuation.

Endpoints

POST /v1/mcp/oauth/authorize

Approves one Tenant-owned setup continuation and launches authorization-code OAuth. The setup token is opaque, single-purpose, and expires.

Request

Requires a dashboard Supabase JWT. The dashboard JWT selects the Tenant ownership boundary; the authenticated administrator and every referenced resource must belong to that Tenant.

Location	Field	Required	Description
Header	`Authorization`	yes	Dashboard Supabase JWT; Tenant API keys are rejected.

Location	Field	Required	Description
Header	`Content-Type`	yes	`application/json`
Body	`setupToken`	yes	Opaque token from MCP connect

Response

Status	Body	Lifecycle effect
`200 OK`	`mcpOauthAuthorizationLaunchResponseSchema`	Creates a short-lived browser authorization launch URL

Opening the returned URL reaches the unauthenticated protocol-support routes GET /v1/mcp/oauth/authorize and GET /v1/mcp/oauth/callback. Those browser redirect routes, plus client metadata discovery, are not authenticated operations in this inventory.

Errors

400 invalid_request covers malformed, expired, already-used, or wrong-owner setup state. Only authentication without a dashboard JWT and its authUserId returns 403 invalid_request. See REST errors.

cURL

curl --request POST "$BLAZING_AGENTS_BASE_URL/v1/mcp/oauth/authorize" \
  --header "Authorization: Bearer $BLAZING_AGENTS_DASHBOARD_JWT" \
  --header "Content-Type: application/json" \
  --data '{"setupToken":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}'

No SDK method: this administrator-only approval consumes a dashboard JWT's authUserId, while the backend SDK authenticates with a Tenant API key. mcpConnections.connect() returns the dashboard continuation that this operation approves. See MCP connections and Connect an MCP server.

On this page