OAuth

Use browser-based OAuth when an end user connects Jinko to a compatible MCP client. Use an API key for the CLI and new SDK integrations. CLI OAuth login is deprecated.

MCP OAuth (DCR)

MCP OAuth is the simplest option for end-user-facing MCP clients. The client discovers Jinko’s authorization server, registers itself, and runs OAuth 2.1 with PKCE in the user’s browser.

Supported clients

Claude Desktop or Claude Web: Open Settings, then Connectors, then Add custom connector. Enter https://mcp.builders.gojinko.com/mcp and leave the OAuth fields blank.
Claude Code: Run claude mcp add --transport http jinko https://mcp.builders.gojinko.com/mcp.
ChatGPT: Add the connector in the MCP settings on desktop or web.
Cursor: Open Settings, then MCP Servers, and add the endpoint URL.

What happens under the hood

Discovery

The client reads https://mcp.builders.gojinko.com/.well-known/oauth-authorization-server to find the authorization server at auth.gojinko.com.

Dynamic Client Registration

The client registers itself and receives a client ID and secret. No user action is required.

Authorization with PKCE

The client opens auth.gojinko.com in a browser. The user signs in or creates an account, then Jinko redirects the client with an authorization code.

Token exchange

The client exchanges the code for access and refresh tokens, then stores them using its normal credential storage.

Account auto-provision

On first use, Jinko reads the JWT sub claim and creates the user without a waitlist or manual approval.

The client refreshes tokens automatically.

CLI and SDK authentication

The CLI accepts API keys, including interactive key entry with jinko auth login:

jinko auth login --key jnk_t_...

The SDK can read and refresh existing OAuth credentials from its shared configuration. The CLI no longer creates OAuth credentials. Do not pass an OAuth token to the SDK’s apiKey option.

OAuth on the REST API

The REST gateway accepts Jinko OAuth bearer tokens and jnk_ API keys. Ownership and route permissions still apply.

curl https://api.gojinko.com/v1/flight_search \
  -H "Authorization: Bearer <oauth_token>" \
  -H "Content-Type: application/json" \
  -d '{ "origin": "JFK", "destination": "CDG", "trip_type": "oneway", "departure_date": "2027-06-15" }'

The REST gateway sends a non-key bearer token to the backend for verification. API keys can use X-API-Key: jnk_t_... or Authorization: Bearer jnk_t_.... New tenant keys start with jnk_t_ in production and jnk_sandbox_t_ in sandbox. Older person-bound keys with the jnk_ prefix remain valid as legacy keys. MCP OAuth has its own client-managed sign-in flow. An existing CLI token is not automatically valid on MCP.

Which auth should I use?

Scenario	Recommended
Building an MCP server or agent for end users	MCP OAuth with dynamic client registration
Server-side script, CI, agent backend	API key, long-lived, no refresh logic
Local development with the CLI	API key, saved with `jinko auth login --key jnk_t_...`
Single-script automation on a workstation	API key, shared by the CLI and SDK

Use an API key when no user-facing sign-in is needed.

Common failures

Symptom	Cause	Fix
`401 unexpected iss claim` on MCP endpoint	You pasted a CLI OAuth token where a JWT-from-AuthKit was expected	Use an API key (`jnk_t_...`) on MCP, or use a client that supports DCR
MCP client can’t reach the auth server	Network or proxy blocking `auth.gojinko.com`	Allow `auth.gojinko.com`, `mcp.builders.gojinko.com`, and `api.gojinko.com`
Token refresh fails after a long idle period	Refresh token also expired	Sign in again through the MCP client, or configure an API key for CLI or SDK use

See Errors & troubleshooting for HTTP-level debugging.

Getting started

Guides

Marketing claim

Authentication

Connect

Developer Platform

Concepts

MCP OAuth (DCR)

Supported clients

What happens under the hood

CLI and SDK authentication

OAuth on the REST API

Which auth should I use?

Common failures

​MCP OAuth (DCR)

​Supported clients

​What happens under the hood

​CLI and SDK authentication

​OAuth on the REST API

​Which auth should I use?

​Common failures

MCP OAuth (DCR)

Supported clients

What happens under the hood

CLI and SDK authentication

OAuth on the REST API

Which auth should I use?

Common failures