Skip to main content
Glood exposes one MCP endpoint. Any client that implements the Model Context Protocol and its authorization spec can connect — there is no Glood-specific SDK, and no key to paste.

​
What your client needs to support

Streamable HTTP transport — not SSE, and no session id to carry
OAuth 2.1 authorization code flow with PKCE (S256)
Dynamic client registration (RFC 7591), or a client we issue by hand
That is the whole requirement. Clients that already speak MCP authorization — Claude Code, claude.ai, ChatGPT, Codex, Gemini CLI, opencode, and anything built on an MCP SDK — need nothing beyond the URL.

​
How the connection opens

Nothing is configured in advance. Your client discovers every endpoint it needs starting from a 401:
1

Your client calls the endpoint and gets a 401

The response carries the pointer it needs:
2

It reads the protected resource metadata (RFC 9728)

Which names Glood as the authorization server for this resource.Both URL forms are served — the bare path and the path-suffixed form (/.well-known/oauth-protected-resource/api/v1/mcp) — because clients build it both ways.
3

It reads the authorization server metadata (RFC 8414)

/.well-known/oauth-authorization-server gives it the authorize, token and registration endpoints.
4

It registers itself (RFC 7591)

Unauthenticated, and it becomes a public client. Nothing is shared in advance, so there is no credential to leak or to rotate.
5

Your browser opens the consent screen

Tick which organizations this connection may reach, approve, and the client exchanges its code for a token on its own.

​
What the server advertises

​
Token lifetimes

Revoking a connection from the dashboard kills every credential it holds immediately, refresh tokens included. See Access and privacy.

​
The one exception

ChatGPT Custom GPTs with Actions cannot do dynamic registration. That path alone needs a pre-registered confidential client — a client id and secret, issued against ChatGPT’s fixed redirect URI. Email support@glood.ai for one; see Custom GPT and Actions. Every other client registers itself.

​
Scope of a connection

A token is scoped to the organizations you ticked at consent, and carries your own role in each of them. The two together are the ceiling: a tool call that your role does not permit in that organization is refused, exactly as it would be in the dashboard. There is no tool that widens a connection’s reach — structurally, not by policy. See Access and privacy.

​
Self-hosted or staging

The URL is the only thing that changes. Point your client at your own API host and discovery does the rest: the well-known documents are served from that origin and name it as their own issuer.