Docs

Connecting over OAuth

For hosted clients that cannot hold an API key.

An API key is the fastest way in, but hosted clients that cannot store one (claude.ai connectors and similar) can authorize as you instead. We are an OAuth 2.1 authorization server: clients discover us at /.well-known/oauth-authorization-server, register themselves, and send you here to approve what they are asking for.

Shell 
# what a client discovers
GET https://mcpmailer.com/.well-known/oauth-authorization-server
GET https://connect.mcpmailer.com/.well-known/oauth-protected-resource

# and then, with a token
curl https://connect.mcpmailer.com/mcp \
  -H "Authorization: Bearer <access token>" \
  -H "X-MCPmailer-Agent: sales"

Scopes

Scopes are deliberately coarse: mail:read, mail:send, contacts, notes, and vault. Vault is the one to be careful with, since it reads credentials, so grant it only to agents that need one. Ask for offline_access if the agent runs unattended and needs to refresh. PKCE is required, and tokens are audienced to the MCP endpoint, so a token minted for another service is refused here.

Choosing an agent

A token identifies you, not one of your agents. If you have a single agent the connection uses it. If you have several, name one with an X-MCPmailer-Agent header carrying its handle, and we refuse rather than guess: picking for you would mean mail leaving the wrong address.

Revoke a connection at any time from Connections in the dashboard; the app is cut off immediately and has to ask again.