Skip to content
warmupDocs

MCP authentication

Section titled “OAuth (recommended)”

The Warmup MCP server follows the MCP authorization specification. You don’t need to create keys: the client registers itself and you only sign in and approve access.

client ── POST /mcp (no token) ─────────▶ 401, WWW-Authenticate: resource_metadata=…
client ── GET protected resource metadata ▶ authorization server URL
client ── discovery + registration + PKCE ▶ authorization server
you    ── sign in to Warmup, click Allow ─▶ client receives an access token
client ── POST /mcp, Bearer <token> ─────▶ MCP server ──▶ Warmup API
  • Discovery: https://mcp.warmup.social/.well-known/oauth-protected-resource/mcp (RFC 9728). For older clients the server also serves /.well-known/oauth-authorization-server.
  • Access tokens are short-lived. When one expires, the server answers 401 and the client refreshes it with its refresh token.
  • An OAuth token only works for your data and can’t manage API tokens.

To revoke a client’s access, open the dashboard: MCP → Connected apps → Revoke.

API token

Section titled “API token”

For clients and scripts without OAuth support, send an API token in the Authorization header.

  1. Create a token in the dashboard: API tokens.
  2. Pass it to the client:
Terminal window
claude mcp add --transport http warmup https://mcp.warmup.social/mcp \
  --header "Authorization: Bearer wmp_YOUR_TOKEN"