Skip to main content
Web connectors such as claude.ai and ChatGPT cannot use an API key. They use browser sign-in instead, built on a standard called OAuth: the app sends you to Groovin, you sign in and approve, and the app gets a temporary pass.

​
What happens

  1. You add the MCP server address to your AI tool.
  2. The tool opens the Groovin sign-in page in your browser.
  3. You sign in with Google or Microsoft, using your Groovin account.
  4. You click Approve.
  5. The tool can now use Groovin on your behalf.
If the tool already has your approval, you see an Already authorized page with a Continue button.

​
Sign-in fails

​
”Couldn’t register with Groovin’s sign-in service”

Sometimes with an ofid_… reference. The tool could not set itself up automatically.
  1. In the Groovin extension, open Settings → MCP and API, and copy the OAuth Client ID.
  2. In your connector’s Advanced settings, paste it in the OAuth Client ID field.
  3. Leave the Client Secret empty.
  4. Connect again.
Retrying a few minutes later can also work. If it persists, send the ofid_… reference to support.

​
”No Groovin account is linked to…”

You signed in with an email that has no Groovin account. Disconnect the connector, and reconnect with your Groovin email.

​
When the connection expires

Browser sign-in does not last forever, and some AI tools do not renew it on their own. When that happens, every Groovin call starts failing at once, even in the middle of a conversation. This is not a Groovin outage, and not a LinkedIn restriction. Reconnect the Groovin connector in your tool’s settings. If your tool supports headers, an API key avoids the problem entirely.

​
Technical details

For anyone building their own client:
  • A request with no credentials gets a 401 with a WWW-Authenticate: Bearer header holding a resource_metadata address.
  • The server publishes its protected resource metadata at /functions/v1/mcp-server/.well-known/oauth-protected-resource.
  • That document names the authorization server, on a different host from the MCP server. Read it from there rather than hard-coding it.
  • Dynamic client registration is supported. The scopes are openid, email and profile.
  • An expired or invalid token gets a 401 with error="invalid_token", on every request.
Browser sign-in tokens work on the MCP server. They cannot manage webhooks.