Documentation menu

Authentication

The hosted MCP endpoint requires authentication, including on the Free plan. Use browser OAuth in supported AI clients or an API key for scripts and custom-header clients. Public documentation and service-health probes do not require an account.

Last updated 2026-10-14

OAuth 2.1 (recommended)

OAuth 2.1 is the recommended path for clients that support remote MCP servers, such as Claude and ChatGPT. You add the canonical endpoint and sign in through your browser — no API key is created, copied, or stored in the client configuration. The server advertises its authorization server at /.well-known/oauth-protected-resource/mcp, and a compliant client discovers and completes the flow for you.

MCP endpoint

https://mcp.nflmcp.com/mcp

Use the public Claude setup guide or ChatGPT setup guide. Your AI client's subscription and workspace permissions are separate from your NFL MCP account.

Follow the dashboard quickstart for exact, copy-paste configuration for each supported client.

Dynamic registration is not anonymous access

Dynamic client registration lets a compatible client register itself with the authorization server without asking you to configure a client ID or secret. It does not skip your browser login or consent. Do not select a client's no-authentication mode for the hosted MCP endpoint. There is no anonymous Free endpoint or x402 payment route available today.

API key

Use a static API key for scripts, backend jobs, or clients that do not support remote OAuth. Create a key in the dashboard — the raw value is shown once at creation, so store it somewhere safe. Send it as a bearer token on every request:

Authorization header

Authorization: Bearer YOUR_API_KEY

Keys are account-scoped. Daily usage is counted per account across every key you own, so rotating or adding keys does not reset your usage. See Rate limits & quotas.

Which should I use?

Use	When
OAuth 2.1	Interactive MCP clients that support remote sign-in (Claude, ChatGPT, and other OAuth-capable clients). No secret to manage.
API key	Scripts, servers, CI, or clients without remote OAuth. You manage the secret and send it as a bearer token.

Verify your connection

To confirm a key and endpoint work, list the tools your account can access. A valid request returns the tool catalog; an invalid or revoked key returns HTTP 401 with { "error": { "code": "invalid_key" } }.

Connectivity smoke test

curl -X POST https://mcp.nflmcp.com/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

This is a low-level connectivity check against the hosted stateless server. For a complete protocol connection, use an MCP SDK or client that negotiates initialization, sends protocol headers, and handles the server's event-stream responses. Tool discovery authenticates but does not consume daily quota.

Troubleshoot sign-in

A 401 means the server needs a valid credential: reconnect through OAuth or check whether your API key was revoked. Missing custom-app controls usually require checking the AI client's plan or workspace policy. A 403 can indicate a tool outside your NFL MCP plan; a 429 is an account-wide quota limit, not a reason to rotate credentials. Never put tokens or keys into conversation text or public URLs.