How does OAuth sign-in work for MCP clients?

How does a client find the sign-in server?

• Protected resource metadata: /.well-known/oauth-protected-resource/mcp
• Authorization server metadata: /.well-known/oauth-authorization-server

An MCP request to https://getinboxtriage.com/mcp without a token returns 401 with a WWW-Authenticate header that points to this metadata, which most MCP clients follow automatically. Opening the URL in a browser shows setup steps instead.

What does the person see?

An Allow access page that names the client and lists what it can do: read and search mail, write drafts, label, archive, or trash, and send only after approval. They choose Allow or Deny.

How long does sign-in last?

The app refreshes its access on its own, so the person does not sign in again during normal use. If an app keeps asking you to sign in, disconnect it under Connected agents and connect again.

What if sign-in fails?

• If the page says to confirm your email address, open the confirmation link we emailed you (or send a new one from Settings), then start Connect again in your app.
• If it says to sign in to the account that started this connection, sign out, sign in to the right account, and start Connect again.
• If you chose Deny by mistake, start Connect again.

How do I disconnect an app?

In Settings, under Connected agents, choose Disconnect next to the app. Access ends right away, and the app must sign in again to reconnect. Disconnect all agents and API keys removes every app and key at once.

Errors and other details are in the API reference.