Per-domain OAuth (closed)

This path is closed. Use the one connector.

Use Connect the DFL MCP: one URL, https://mcp.devfellowship.com/mcp, one sign-in and one approval for every domain. The per-domain OAuth connectors on this page closed on 2026-10-30. A new per-domain OAuth connection is refused, and the message names the one URL. A connection that you already made works until you remove it. Remove yours on the connections page and add the one connector. Removing a connector inside your client does not remove it at DFL. The page stays for the callback and troubleshooting notes that the one connector shares. The steps below do not work for a new connection.

Some MCP clients, including the ChatGPT desktop app and Cursor agents (which Tainan’s Grok bot uses), cannot take a pasted bearer token. They connect with OAuth: you sign in with your DFL account in the browser, approve what the client may read, and the client receives its own short-lived token. You never copy a token by hand.

One sign-in for every host

You sign in once. The DFL consent page at learn.devfellowship.com keeps your sign-in for 12 hours. The next host that you connect in that time shows “Signed in as …” with your email. You do not type a password again. You click Approve one time for that host.

• Each host still gets its own token and its own approval. A token for one host is refused by every other host.
• “Not you? Sign out” ends the sign-in on the consent page only. Clients that you already connected keep working.
• After 12 hours the consent page asks for your password again, on the next connection.

Which hosts accept OAuth

All 15 DFL MCP hosts accept OAuth. Add one server per host that you need.

Host	Endpoint to add
Skills	https://skills.mcp.devfellowship.com/mcp
Campaigns	https://campaigns.mcp.devfellowship.com/mcp
Learn	https://learn.mcp.devfellowship.com/mcp
Platform (ops)	https://ops.mcp.devfellowship.com/mcp
Lesson Studio	https://studio.mcp.devfellowship.com/mcp
Engineering	https://engineering.mcp.devfellowship.com/mcp
Events	https://events.mcp.devfellowship.com/mcp
Accounting ledger (financing)	https://financing.mcp.devfellowship.com/mcp
Payments	https://payments.mcp.devfellowship.com/mcp
Plans	https://plans.mcp.devfellowship.com/mcp
Proposals	https://proposals.mcp.devfellowship.com/mcp
Forms & quizzes	https://quiz.mcp.devfellowship.com/mcp
Strategy	https://strategy.mcp.devfellowship.com/mcp
Work	https://work.mcp.devfellowship.com/mcp

Every tool of a host is available over OAuth. Each tool is either a read tool or a write tool. A read grant calls only the read tools. Your IAM role still applies: for example, payments and quiz refuse a member below the finance or admin level, with OAuth exactly as with dfl-auth.

ChatGPT desktop

Where to run it

Connect from the ChatGPT desktop app on your own computer (Settings → Integrations → Plugins → MCPs → Connect to a custom MCP, type Streamable HTTP). The file ~/.codex/config.toml is the one on that computer. The desktop app, the Codex CLI and the IDE extension share it (OpenAI: MCP); Codex reads $CODEX_HOME/config.toml when CODEX_HOME is set, else ~/.codex/config.toml.

Do not run codex mcp login inside a ChatGPT agent’s computer (the Linux sandbox, agent@…:/workspace). That sandbox cannot reach the DFL hosts: on 2026-10-22 curl to every host failed there with “Could not connect to server”, so OAuth discovery fails before any DFL check runs. Its config.toml is also not the one the desktop app uses.

1. Fix the callback port first. Open ~/.codex/config.toml. At the top level, before any [section], add:

   ~/.codex/config.toml

   mcp_oauth_callback_port = 33418

   Do this before your first Authenticate. The port is part of the callback address that is registered for your connection. A server that you authenticated without the setting must be removed and added again.

2. Add one server per host. Go to Settings → Integrations → Plugins → MCPs → Connect to a custom MCP. Choose the type Streamable HTTP. Enter the endpoint from the table, for example https://skills.mcp.devfellowship.com/mcp. Repeat for each host you need.

3. Click Authenticate. The DFL consent page opens in your browser. Sign in with your DFL account. If you signed in during the last 12 hours, the page shows “Signed in as …” and skips the password. Choose who the client acts as (see This client acts as). Approve read access. Write access is optional. Click Approve.

4. Check it. Back in the app, ask for something small, for example to list skills on the Skills host. A successful tool result means the connection works.

Grok (through Cursor agents)

Tainan’s Grok bot reaches the DFL MCP through Cursor’s agent MCP OAuth. Cursor returns to the callback https://www.cursor.com/agents/mcp/oauth/callback, which the DFL hosts accept as an exact match (approved by Tainan, 2026-10-22).

1. Add the server in Cursor’s agent MCP settings. Use the endpoint from the table, for example https://skills.mcp.devfellowship.com/mcp. One server per host.

2. Sign in when Cursor asks. The DFL consent page opens. Sign in with your DFL account. Cursor requests only the email scope: that is identity only and grants no tool by itself. You choose read (default) or read + write on the consent page, and who the client acts as (see This client acts as).

3. Check it. Ask the agent to call a read tool, for example list skills.

This client acts as

The consent page asks “This client acts as”. You choose one of two:

• Myself. The client acts with your own DFL identity.
• An agent that you delegated, for example grok-capo. The Approve button then says “Approve as <name>”.

DFL records the actor on every call that the client makes. A write tool needs an actor. A grant without an actor is read-only, even if you selected write. If the page says that the client can only read, your account has no actor yet. Ask a DFL admin.

Read and write

Read is pre-selected and required. Write is optional: leave it off unless the client must change data. Every host tool is either a read tool or a write tool.

You can add write later without a new connection. See Manage your connections.

Who may connect: access level

Each host has a minimum DFL access level. The default is member. If your access level is lower, the consent page refuses the connection and names the host. Ask a DFL admin for the access, then connect again. Your IAM role still applies to every call after you connect.

Other MCP clients

A client can connect when it supports Streamable HTTP, OAuth dynamic client registration, PKCE S256 and one of the allowed callbacks: http://127.0.0.1:<port>/callback[/<id>] and http://localhost:<port>/callback[/<id>] (desktop clients and Claude Code), the exact loopback path http://127.0.0.1:<port>/oauth/callback and http://localhost:<port>/oauth/callback (no suffix, no query), https://chatgpt.com/connector_platform_oauth_redirect, https://chatgpt.com/connector/oauth/<id>, https://www.cursor.com/agents/mcp/oauth/callback and https://claude.ai/api/mcp/auth_callback. These cover ChatGPT, Cursor agents, Claude.ai, and loopback callbacks (Claude Code, Codex and desktop clients). Any other callback is refused. Ask in the plan to add one; each addition is an exact URI with a recorded approval.

Manage your connections

Open learn.devfellowship.com/oauth/grants to see every client you approved. For each connection you can:

Action	What it does
Add write	Gives the connection write access. You choose the actor in the same step. You do not reconnect. The write tools appear in a new MCP session: start a new chat or reconnect the server in the client to see them.
Add a domain (read)	Adds a domain that this connection does not have, with read access only. You do not reconnect. Your access level must meet the minimum of the domain. The tools of the domain appear in a new MCP session.
Remove write	Returns the connection to read-only. It is effective at once, also inside an open session.
Change the actor	Changes who the client acts as. DFL records the new actor on the next call.
Remove this connection	Revokes the connection. The client is refused on its next request.

Security properties

• PKCE with S256 only. The plain method is refused.
• Short-lived access tokens, at most one hour. A client renews with its refresh token while the grant stays active.
• One audience per host. A token issued for one host is refused by every other host.
• RLS as you. The token is a real user token, so Row-Level Security and your IAM role apply exactly as with dfl-auth. See Auth & security.
• You approve the scope. Read access is the default. Write access is a separate approval, and it needs an actor.
• One audit trail. DFL records the client and the actor on every call.

Troubleshooting

• “OAuth metadata discovery failed … error sending request”. The client cannot reach the host at all. Check the network from the same machine (curl -I https://skills.mcp.devfellowship.com/.well-known/oauth-authorization-server must answer 200). A ChatGPT agent sandbox has no route to the hosts; use the desktop app on your computer.
• Authenticate fails right after you approve. The callback port setting may have been missing at the first Authenticate. Add mcp_oauth_callback_port = 33418, remove the server and add it again.
• 401 after some time. The grant was revoked, or the token expired and could not be renewed. Click Authenticate again.
• 403 insufficient_scope. You approved read access only, and the tool writes. Open the connections page and click Add write. Then start a new MCP session.
• Write tools are missing after “Add write”. A host lists its tools when an MCP session starts. Start a new session in the client.
• A write is refused with “actor required”. The connection has no actor. Use Add write or Change the actor and choose an actor.
• The consent page refuses the host. Your DFL access level is below the minimum of that host. Ask a DFL admin.
• A tool works on one host but not on another. Each host has its own grant and audience. Authenticate each server separately.