# Authentication

> OAuth 2.1 for connectors, Bearer API keys for agents and scripts.

## OAuth 2.1 (connectors)

**Connector sign-in is coming at launch; until then, use an [API key](#api-keys).**

Claude and ChatGPT connectors use OAuth. GroundTruthData's website is the **authorization server**;
the MCP endpoint is the **protected resource**.

| | URL |
|---|---|
| Protected resource metadata | `https://mcp.groundtruthdata.co.za/.well-known/oauth-protected-resource` |
| Authorization server metadata | `https://groundtruthdata.co.za/.well-known/oauth-authorization-server/api/auth` |
| Authorize | `https://groundtruthdata.co.za/api/auth/oauth2/authorize` |
| Token | `https://groundtruthdata.co.za/api/auth/oauth2/token` |
| JWKS | `https://groundtruthdata.co.za/api/auth/jwks` |

- Clients identify themselves with a **Client ID Metadata Document** (an HTTPS URL as `client_id`).
  Dynamic Client Registration is not enabled.
- Authorization code flow with **PKCE (S256)** only.
- Access tokens are short-lived JWTs whose audience is the MCP endpoint.

## API keys

Create keys in [Dashboard → API keys](/app/keys). Send them as a Bearer token:

```http
Authorization: Bearer gtd_test_example
```

- `gtd_live_…` keys count against your plan. `gtd_test_…` keys are for development.
- We store only a SHA-256 hash; a lost key cannot be recovered, only replaced.
- Each plan has a maximum number of active keys.