> ## Documentation Index
> Fetch the complete documentation index at: https://docs.groovin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Browser sign-in

> How web connectors sign in to Groovin, and what to do when it fails.

Web connectors such as claude.ai and ChatGPT cannot use an API key. They use browser sign-in instead, built on a standard called OAuth: the app sends you to Groovin, you sign in and approve, and the app gets a temporary pass.

## What happens

1. You add the [MCP server address](https://docs.groovin.ai/reference/mcp/connect.md) to your AI tool.
2. The tool opens the Groovin sign-in page in your browser.
3. You sign in with Google or Microsoft, using your Groovin account.
4. You click **Approve**.
5. The tool can now use Groovin on your behalf.

If the tool already has your approval, you see an **Already authorized** page with a **Continue** button.

## Sign-in fails

### "Couldn't register with Groovin's sign-in service"

Sometimes with an `ofid_…` reference. The tool could not set itself up automatically.

1. In the Groovin extension, open **Settings → MCP and API**, and copy the **OAuth Client ID**.
2. In your connector's **Advanced settings**, paste it in the OAuth Client ID field.
3. Leave the Client Secret empty.
4. Connect again.

Retrying a few minutes later can also work. If it persists, send the `ofid_…` reference to support.

### "No Groovin account is linked to…"

You signed in with an email that has no Groovin account. Disconnect the connector, and reconnect with your Groovin email.

## When the connection expires

Browser sign-in does not last forever, and some AI tools do not renew it on their own. When that happens, every Groovin call starts failing at once, even in the middle of a conversation.

This is not a Groovin outage, and not a LinkedIn restriction. Reconnect the Groovin connector in your tool's settings. If your tool supports headers, an [API key](https://docs.groovin.ai/reference/mcp/connect.md) avoids the problem entirely.

## Technical details

For anyone building their own client:

* A request with no credentials gets a `401` with a `WWW-Authenticate: Bearer` header holding a `resource_metadata` address.
* The server publishes its protected resource metadata at `/functions/v1/mcp-server/.well-known/oauth-protected-resource`.
* That document names the authorization server, on a different host from the MCP server. Read it from there rather than hard-coding it.
* Dynamic client registration is supported. The scopes are `openid`, `email` and `profile`.
* An expired or invalid token gets a `401` with `error="invalid_token"`, on every request.

Browser sign-in tokens work on the MCP server. They cannot manage webhooks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.