FinchreachConnect your LinkedIn

Authentication

Finchreach accepts two credentials: OAuth 2.1 access tokens, which MCP clients like ChatGPT and Claude obtain on their own after you approve a consent page, and API keys you create in the dashboard. Both go in Authorization: Bearer <token> and are limited by scopes.

OAuth 2.1 for ChatGPT, Claude and other MCP clients

The MCP server at https://mcp.finchreach.com/mcp is an OAuth 2.1 protected resource, following the MCP authorization spec. A client that gets a 401 discovers everything it needs and signs you in:

  1. Discovery: the 401 points to https://mcp.finchreach.com/.well-known/oauth-protected-resource/mcp (RFC 9728), which names the authorization server; its metadata is at https://mcp.finchreach.com/.well-known/oauth-authorization-server (RFC 8414).
  2. Registration: the client registers itself at https://mcp.finchreach.com/register (RFC 7591 dynamic client registration, public clients only).
  3. Authorization: the client sends you to https://mcp.finchreach.com/authorize with PKCE (S256, required) and resource=https://mcp.finchreach.com/mcp (RFC 8707). You sign in to Finchreach and approve the scopes on the consent page.
  4. Tokens: the client exchanges the code at https://mcp.finchreach.com/token. Access tokens last 1 hour; refresh tokens last 30 days and rotate on every use.
  5. Revocation: https://mcp.finchreach.com/revoke (RFC 7009).

OAuth tokens can carry every scope except api_keys:manage: accounts:read, accounts:write, linkedin:read, linkedin:write, actions:read, actions:approve.

API keys

Create a key under API keys, pick its scopes and copy it: it is shown once and stored only as a hash. Send it to the MCP server or the REST API:

Header
Authorization: Bearer <your key>

Revoke a key from the same page; it stops working at once. Each key has its own rate limits.

Scopes

ScopeAllows
accounts:readList connected LinkedIn accounts
accounts:writeConnect, pause and remove accounts
linkedin:readEvery LinkedIn read tool
linkedin:writeEvery LinkedIn write tool (queued for approval when approval is on)
actions:readRead the status of pending actions
actions:approveApprove or reject pending actions (not with the key that proposed them)
api_keys:manageCreate and revoke API keys (API keys only)

An MCP client only sees the tools its scopes allow. A call without the scope fails with insufficient_scope (Errors).

Updated · Markdown version