Sign in (OAuth)

import { Aside } from ‘@astrojs/starlight/components’;

Requires **MCPWP 3.7.0+** on the site. Claude Desktop, Claude Code, Cursor, and Windsurf are unchanged — they keep using an [API key](/reference/auth/) in a header. Sign-in is specifically for **claude.ai (web) and ChatGPT**, which have no field for a custom header or key.

Pasting an API key works everywhere, but claude.ai’s and ChatGPT’s web UIs only accept a connector URL — no header, no key field. Sign-in solves that: instead of copying a key, the end user authorizes with an account, the same way they’d connect any other OAuth-based service.

The OAuth 2.1 logic — Dynamic Client Registration, consent screens, token issuance — is hosted once, centrally, on mumcp.com, a Cloudflare-hosted broker. Your WordPress site doesn’t run its own OAuth server; it enrolls with the broker and then validates tokens the broker issues.

One-time setup (site owner)

An admin enables this once per site:

1. WP Admin → MCPWP → Setup
2. Click “Connect to mumcp.com”
3. Approve the enrollment

That’s it — the site is now reachable through the broker. This step requires WordPress admin access; end users connecting afterward don’t need it.

Connecting (end user)

Once a site is enrolled, anyone with the site’s OAuth connect URL can sign in — no plugin API key involved:

1. In claude.ai (or ChatGPT), add the site’s connector URL
2. Click sign in — you’re sent to mumcp.com
3. Sign in to your mumcp.com account (via email magic-link — no password to set)
4. Review and approve the consent screen (what the connection can access)
5. You’re redirected back, connected

From here the AI client calls the same MCP tools as any other connect method.

What OAuth tokens can and can’t do

• Tokens issued through sign-in are capped at read/write scope. Administrative actions (settings, API key management, integrations config, etc.) are not available over OAuth — those stay on the deliberate, admin-initiated API-key path.
• Every request is validated by your site against the broker (token introspection) before it’s honored.
• Tokens are audience-bound — a token issued for one site cannot be replayed against a different site.

Disconnecting

WP Admin → MCPWP → Setup → Disconnect revokes the site’s enrollment immediately. This is a local kill-switch: it takes effect on your site right away, independent of the broker, so you’re never waiting on a third party to cut access.

When to use the API key instead

Sign-in doesn’t replace the API key — it adds a second path for clients that can’t hold one:

• Claude Desktop, Claude Code, Cursor, Windsurf — keep using the API key, it’s the full-access, works-everywhere method.
• claude.ai (web), ChatGPT — use sign-in for the no-secret-to-copy flow, or the direct API-key connector link if you’d rather not use an account.

→ See Authentication for how the plugin validates both API keys and OAuth tokens.