Inbox TriageSigning in with OAuth
MCP clients that support OAuth 2.1 sign in on their own: they discover Inbox Triage's authorization server, open a browser
for the person to sign in and choose Allow, and receive a token. No API key is needed.
Discovery
- Protected resource metadata:
/.well-known/oauth-protected-resource/mcp - Authorization server metadata:
/.well-known/oauth-authorization-server
A request to https://getinboxtriage.com/mcp without a token returns 401 with a pointer to this metadata, which most MCP
clients follow automatically.
What the person sees
An Allow access page that names the client and lists what it can do: read and search mail, write drafts, label, archive, or trash, and send only after approval. They choose Allow or Deny.
Revoking
The person can disconnect any client in Settings, under Connected agents. The client must then sign in again.
Full details, including token lifetimes and errors, are in the API reference.
Still stuck? Email help@getinboxtriage.com.