Authentication
OAuth 2.1 for connectors, Bearer API keys for agents and scripts.
OAuth 2.1 (connectors)
Connector sign-in is coming at launch; until then, use an API key.
Claude and ChatGPT connectors use OAuth. GroundTruthData's website is the authorization server; the MCP endpoint is the protected resource.
| URL | |
|---|---|
| Protected resource metadata | https://mcp.groundtruthdata.co.za/.well-known/oauth-protected-resource |
| Authorization server metadata | https://groundtruthdata.co.za/.well-known/oauth-authorization-server/api/auth |
| Authorize | https://groundtruthdata.co.za/api/auth/oauth2/authorize |
| Token | https://groundtruthdata.co.za/api/auth/oauth2/token |
| JWKS | https://groundtruthdata.co.za/api/auth/jwks |
- Clients identify themselves with a Client ID Metadata Document (an HTTPS URL as
client_id). Dynamic Client Registration is not enabled. - Authorization code flow with PKCE (S256) only.
- Access tokens are short-lived JWTs whose audience is the MCP endpoint.
API keys
Create keys in Dashboard → API keys. Send them as a Bearer token:
Authorization: Bearer gtd_test_examplegtd_live_…keys count against your plan.gtd_test_…keys are for development.- We store only a SHA-256 hash; a lost key cannot be recovered, only replaced.
- Each plan has a maximum number of active keys.