Skip to main content
Arlo Health uses OAuth 2.1 with PKCE. Users sign in to Arlo in a browser and approve access. Send the resulting access token as a Bearer token on REST requests; MCP clients handle token transport through their OAuth integration.

​
Connector hosts

Claude, ChatGPT, and Grok manage OAuth in their connector interface. They do not advertise init_signup, check_account_status, or register_webhook.

​
OAuth discovery

Read the server metadata rather than hardcoding authorization details. The authorization-server metadata provides the issuer, authorization and token endpoints, client-registration endpoint, supported grant types, and PKCE method. Use the S256 code challenge method.

​
Self-hosted OAuth client

  1. Read the protected-resource metadata and follow its authorization-server metadata URL.
  2. Register a public client using the registration_endpoint.
  3. Create a PKCE verifier and S256 challenge, then direct the user to the authorization endpoint.
  4. Exchange the returned authorization code and verifier at the token endpoint.
  5. Send the access token as Authorization: Bearer <token> on REST calls. The MCP SDK attaches it to MCP requests.
Authorization is interactive and requires a browser. Use a redirect URI that the client can receive: a public HTTPS callback for a remote client or a loopback callback for a local listener.

​
Clients without a bearer token

A stdio or local MCP client that connects before it has a bearer token can call init_signup. It returns authUrl, sessionId, expiresIn, and instructions. Give the URL to the user, then call check_account_status with sessionId until authenticated is true. check_account_status without a sessionId reports account authentication and webhook configuration. See the Authentication tool reference for parameters and response fields.

​
Webhook registration

An authenticated agent runtime can register a public HTTPS callback with register_webhook. The webhook token is sent as a Bearer token on incoming requests. Connector hosts do not expose this tool. See Webhook Tools for event types and payload handling.