MCPBundler Docs
MCPBundler Docs
Volver al marketplacePrimeros PasosAutenticacionTutorial - De un Bundle a un Agente Conectado
API Reference
Agent A2A Tools
Agent Channels
Agent Configuration (Staging)
Agent Configuration (Versions)
Agent Tools
Agents
Auth
Billing
Bundler
Bundler Tool
Bundles
Call Campaigns
Catalog
Conversations
Credentials
Deployments
Discover
Embedding
Fleet
Knowledge Bases
LLM
MCP Listings
Media
OAuth Clients
OAuth2
Initiate OAuth2 FlowOAuth2 Callback
Observability
Organisations
Realtime
Reviews
Roadmap
SCIM
STT
Suppression
Triggers
TTS
Users
Utils
Voices
Webhooks
Workflows
API ReferenceOAuth2

Initiate OAuth2 Flow

Three-step interactive PKCE flow for MCPs that authenticate via OAuth2 rather than a static API key:

  1. POST /oauth2/initiate (this endpoint) - builds the provider's authorization URL and stores the PKCE verifier/state server-side. Redirect the end user's browser to the returned authorization_url.
  2. GET /oauth2/callback - the identity provider redirects here after the user authorizes (or denies) access; this exchanges the code for tokens and redirects back to the frontend URL supplied in step 1.
  3. GET /oauth2/sessions/{deployment_id}/{entry_id} - poll or read this afterward to check connected status; never exposes the tokens themselves. DELETE the same path to disconnect and force a fresh flow.

Calling initiate again for the same deployment/entry overwrites any prior in-flight or completed session.

POST
/v1/oauth2/initiate

Start the PKCE authorization-code flow for an MCP's OAuth2 provider.

Keyed by mcp_namespace, not a deployment: connecting a provider account no longer requires a deployment to exist first, since the resulting credential is reusable across every deployment the caller owns. deployment_id/entry_id are optional and, when both given, are only used to auto-link the resulting credential to that one entry once the callback completes - see oauth_callback.

Args: body: MCP namespace to authorize, optional deployment/entry to auto-link, optional scope override, and the frontend URL to redirect back to once the flow completes. request: Used to build the callback redirect_uri from the current host, so it always matches how this API is being reached. session: Database session. context: Caller's security context; the caller must own the deployment being auto-linked, if one is given.

Returns: The provider authorization URL the frontend should redirect the user to, plus the generated state value.

Authorization

OAuth2AuthorizationCodeBearer
AuthorizationBearer <token>

In: header

Query Parameters

verify_locally?Verify Locally
Defaulttrue

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/v1/oauth2/initiate" \  -H "Content-Type: application/json" \  -d '{    "mcp_namespace": "string",    "redirect_uri": "string"  }'
{  "authorization_url": "string",  "state": "string"}
{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}

OAuth2

Endpoints in the OAuth2 group.

OAuth2 Callback

Next Page

mcp_namespace*Mcp Namespace
Lengthlength <= 256
deployment_id?|null
entry_id?|null
redirect_uri*Redirect Uri

Frontend callback URL.

scope_override?string|null