OAuth 2.1 — sign in from your app
Register the server without a header. The host discovers the authorization server, opens a browser, and you sign in to Gemina and approve the connection. Each connected app gets its own key; revoke it any time under Connected apps in the console. The token carries the mcp scope.
# Claude Code
claude mcp add --transport http gemina https://api.gemina.co/api/v1/mcp/
# then run /mcp inside Claude Code and sign in
# claude.ai and Claude Desktop
# Customize → Connectors → Add → Add custom connector → Paste the URL → Sign in
# URL: https://api.gemina.co/api/v1/mcp/Most hosts need nothing beyond the URL. They register themselves on the first 401 and open your browser.
Three need an explicit second step. One can't sign in at all:
- Codex CLI
codex mcp add gemina --url https://api.gemina.co/api/v1/mcp/ codex mcp login geminaA bare[mcp_servers.gemina]block inconfig.tomlconnects unauthenticated.- OpenClaw
openclaw mcp set gemina '{"url":"https://api.gemina.co/api/v1/mcp/","transport":"streamable-http","auth":"oauth"}' openclaw mcp login geminaBoth are required. OpenClaw has no 401-triggered sign-in.- Hermes-Agent
auth: oauth hermes mcp login geminaOAuth is an explicit opt-in in~/.hermes/config.yaml. Run the login from a fresh terminal: the in-session config reload times out before a browser sign-in finishes.- Cline
- API key onlyNo documented OAuth path for remote servers as of 27 August 2026. Use the API-key lane below.
Discovery documents:
https://api.gemina.co/.well-known/oauth-protected-resource/api/v1/mcpProtected resource metadata (RFC 9728)https://api.gemina.co/.well-known/oauth-authorization-server/api/v1/mcpAuthorization server metadata (RFC 8414)