Sign-in and authentication
The Dyme MCP server requires sign-in. Every request to https://mcp.dyme.earth/api/mcp carries an OAuth access token issued to one Dyme account. A request without one gets HTTP 401 with a WWW-Authenticate header that points to the metadata below, which is how an assistant knows to start sign-in.
Discovery
| Document | Address |
|---|---|
| Protected resource metadata (RFC 9728) | https://mcp.dyme.earth/.well-known/oauth-protected-resource |
| Authorization server metadata (RFC 8414) | https://mcp.dyme.earth/.well-known/oauth-authorization-server |
The flow
OAuth 2.1, authorization code with PKCE (S256 only). Public clients: no client secret.
| Step | Endpoint |
|---|---|
| Register (RFC 7591, dynamic client registration) | POST https://mcp.dyme.earth/register |
| Authorize | https://mcp.dyme.earth/authorize |
| Token (code and refresh) | POST https://mcp.dyme.earth/token |
| User info | https://mcp.dyme.earth/userinfo |
Scopes: openid, profile, email. The traveller signs in with their Dyme account on dyme.earth.
Lifetimes
| Item | Lifetime |
|---|---|
| Authorization code | 5 minutes, single use, bound to the client and its PKCE challenge |
| Access token | 1 hour |
| Connection (refresh) | 90 days from sign-in, however often it is refreshed; then the traveller signs in again |
Approved return addresses
Dynamic registration accepts any client, but the authorization step only redirects to approved callback addresses:
- Claude:
https://claude.ai/api/mcp/auth_callback,https://claude.com/api/mcp/auth_callback - ChatGPT:
https://chatgpt.com/connector_platform_oauth_redirectand ChatGPT's per-connector callbacks on chatgpt.com - Meta Muse:
https://agent.meta.ai/api/hatch/oauth/callback
Any other address is refused. To connect a new assistant or product, email hello@dyme.earth with its callback address.
User info
/userinfo returns the account's sub and email. email_verified is false: signing in to Dyme does not, by itself, prove the inbox.