Authentication

The Teramot MCP server supports two authentication modes. Both pass a Bearer token to the server; pick the one your client supports.

Both modes coexist on the same endpoint, and both grant the same access. The discovery methods initialize and tools/list require no token at all (see Overview → Bootstrap methods).

OAuth 2.0 + PKCE

This is the recommended path for clients that support it. You only configure two values — the MCP URL (https://mcp.teramot.com/mcp) and the Client ID (5nldf3wj83yz9f6zbrsjx). The client opens a browser window, you log in to Teramot, and the client receives and refreshes tokens automatically.

Under the hood the server exposes the standard OAuth 2.0 metadata and endpoints, so most MCP clients configure themselves with no extra input:

• GET /.well-known/oauth-authorization-server — authorization server metadata (RFC 8414)
• GET /.well-known/oauth-protected-resource — protected resource metadata (RFC 9728)
• GET /authorize — authorization endpoint
• POST /token — token endpoint
• POST /register — dynamic client registration

The flow uses PKCE (S256) and the scopes openid email access offline_access. See Connecting your client for per-client steps.

Static API key

For clients that can’t complete the OAuth handshake (Cursor, v0.dev, Antigravity), generate a static API key and send it as a Bearer token.

Generate a key

1. Open the Teramot app and go to the MCP page.
2. In the API Keys section, enter a name (e.g. cursor-work) and click Generate Key.
3. Copy the key now — it won’t be shown again.

You can create multiple keys (one per client/machine) and delete any of them later from the same page.

Use the key

Send it in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Most MCP clients accept a custom header in their server config:

{
  "mcpServers": {
    "teramot": {
      "url": "https://mcp.teramot.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Errors