One line, then sign in when your client asks.
There is no key to paste and nothing to keep out of your config files. The endpoint is an OAuth 2.1 resource server: a client that speaks the MCP authorization spec gets there from the URL alone.
Pick the agent you already run.
Copy the line, run it, and answer the sign-in your client opens. That is the whole setup.
What happens when you run it.
Your client calls the endpoint, gets a 401, follows it to our protected-resource document, registers itself and opens a sign-in in your browser. You approve it once.
Approving starts a 14-day trial on the account you signed in with. Connecting a second client, or later pasting a token, lands on that same account — one plan, one trial, one history.
See your accountIf your client cannot sign in itself.
Some clients cannot run an authorization flow, and curl never will. For those, mint a bearer token and paste it into the header. It is the same account either way, and every call is logged to it.
Shown once — only its hash is stored. To have one revoked without a replacement, write to [email protected].