OAuth sign-in
An HTTP MCP server that answers 401 is ready for sign-in. You do not fix that in the create form.
@mcp signin Docs
@mcp signout Docs@mcp signin <server> finds the authorization server from the WWW-Authenticate resource_metadata link (protected resource metadata, RFC 9728), and falls back to the well-known URLs. It then reads /.well-known/oauth-authorization-server (RFC 8414), then OpenID discovery.
If the server offers dynamic client registration (RFC 7591), the app registers itself. Otherwise it uses the optional OAuth client ID from the server editor.
Sign-in is authorization code with PKCE S256, through a 127.0.0.1 loopback redirect and your browser, with the resource parameter (RFC 8707). The browser opens only when you run the command. Ctrl+C cancels it.
Tokens stay in memory only. They refresh automatically. A call that gets a 401 refreshes once and retries. @mcp signout <server> forgets the tokens. @mcp shows signed in on that row.
A headless termorq-cli run cannot open the browser. Sign in on a machine where you can see the window, or use a server that authenticates with a secret the pipeline can provide. Do not put the access token in the workspace file.
API connections have their own commands, @signin and @signout. Those are not MCP. Auth covers them.