Authentication
OAuth sign-in, tokens and discovery URLs for the GymUp MCP server.
The server uses OAuth with dynamic client registration. MCP clients run the whole flow themselves: you only sign in once in the browser window they open.
Flow
The client calls https://gymup.ai/api/mcp without a token and receives 401 with WWW-Authenticate: Bearer resource_metadata="https://gymup.ai/api/auth/.well-known/oauth-protected-resource".
It reads the discovery documents and registers itself at the registration endpoint.
It opens https://gymup.ai/login in your browser. Sign in with Google or with a code sent to your email, using the account you use in the app. If you signed up in the app with Apple, use the email code with the address Apple shared with GymUp (the relay address if you chose to hide your email).
It exchanges the authorization code for a token and sends Authorization: Bearer <token> on every request.
Signing in with an email that has no GymUp account creates a new account, with no subscription: every tool call then answers requiresSubscription. Sign in with the email of the account that holds your subscription.
Endpoints
| URL | |
|---|---|
| Protected resource metadata | https://gymup.ai/.well-known/oauth-protected-resource (also under /api/auth) |
| Authorization server metadata | https://gymup.ai/.well-known/oauth-authorization-server (also under /api/auth) |
| Client registration | https://gymup.ai/api/auth/mcp/register |
| Authorization | https://gymup.ai/api/auth/mcp/authorize |
| Token | https://gymup.ai/api/auth/mcp/token |
- Grant types:
authorization_code,refresh_token. - PKCE:
S256. - Scopes:
openid profile email offline_access. Requestoffline_accessto receive a refresh token. - Public clients register with
token_endpoint_auth_method: "none".
Tokens
| Token | Lifetime |
|---|---|
| Authorization code | 10 minutes |
| Access token | 1 hour |
| Refresh token | 7 days |
Clients refresh the access token on their own. After 7 days without a refresh, the client opens the sign-in window again.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
401 with JSON-RPC error -32000 "Unauthorized" | Missing, expired or revoked token | Reconnect the server in your client. If it keeps failing, remove the server and add it again so the client registers anew. |
Every tool answers requiresSubscription | The signed-in account has no active subscription | Sign in with the account that holds the subscription, or subscribe in the app. |