Endpoints & auth
Pluggzy is a remote MCP server with OAuth 2.1 (PKCE, refresh tokens, dynamic registration and client ID metadata documents). Most apps only need the server URL.
| POST /mcp | MCP server (Streamable HTTP). Auth: OAuth 2.1 access token or an API key, as Authorization: Bearer … |
| GET /.well-known/oauth-protected-resource | Which authorization server protects /mcp (clients discover OAuth here). |
| GET /.well-known/oauth-authorization-server | OAuth 2.1 metadata: endpoints, scopes, PKCE. |
| GET /authorize | Sign-in and consent page: pick the account and the permissions. |
| POST /oauth/token | Token endpoint (authorization code with PKCE, refresh tokens). |
| POST /oauth/register | Dynamic client registration, for clients without a client ID metadata document. |
Apps without OAuth use an API key, created on the API keys page and sent as Authorization: Bearer <key>. A key belongs to one connected account.