Other MCP clients

Technical reference for connecting non-Claude, non-Cursor, non-ChatGPT MCP clients: OAuth support, the Bearer API-key fallback, and what a client must support.

Updated Sep 17, 2026 3 min read

OAuth compatibility and the Bearer API-key fallback.

The endpoint supports Model Context Protocol over streamable HTTP. OAuth registration is limited to supported callback URLs; OAuth support alone does not make every client eligible. Other callers can use a Bearer API key if they can send an Authorization header.

MCP endpoint

https://agentic.optimonk.com/mcp

What the client needs to support

Streamable HTTP transport. The endpoint is stateless POST; there is no stdio build to install and nothing to run locally.
OAuth with dynamic client registration. The client registers itself and walks the discovery chain — it needs no pre-issued credentials, but every callback URL must be allowed.

Supported OAuth callbacks

Hosted callbacks must use HTTPS on an exact supported host: claude.ai, claude.com, chatgpt.com, chat.openai.com, cursor.com or cursor.sh. Desktop callbacks can use cursor:, vscode: or vscode-insiders:. Local and CLI clients can use HTTP or HTTPS loopback callbacks on localhost, 127.0.0.1 or [::1]. Callback URLs must not contain credentials or fragments.

A hosted client on another domain is rejected during registration, before consent. Use the API-key setup below for those clients.

How discovery works

An unauthenticated call gets a 401 whose WWW-Authenticate header points at the protected-resource metadata, which names the authorization server. A conforming client follows that chain and, if its callback URLs are allowed, registers and opens the consent screen.

Try the discovery chain

curl -i -X POST https://agentic.optimonk.com/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

If OAuth is unsupported or registration is rejected

Create an API key under Settings → API & Connected apps and send it as a Bearer token. Same endpoint, same tools — see Authentication & access.

What you should see

For OAuth, complete your client’s authentication flow, then approve the requested OptiMonk permissions. See Authentication & access for consent-screen details and connection management.

Check it worked

Ask your agent to call whoami. It answers with the account it is acting as and the permissions it holds, which is also the first thing to check if a later call says something is missing.

If it does not connect

Nothing happens after adding the URL. Complete your client’s authentication step first. If the consent tab is blocked, allow pop-ups for this site and retry.
You were asked for a key or token. OAuth connections do not require an API key. If your client does not support OAuth or its callback is not allowed, use a Bearer API key instead — see Authentication & access.
Connected, but calls fail. Call whoami first: a credential on the wrong account fails exactly like a missing object.