# VolunteerReminder MCP authentication

VolunteerReminder MCP is a Streamable HTTP server. Claude, ChatGPT, and Grok
connectors complete VolunteerReminder's OAuth Allow screen. Cursor-style clients
may paste `Authorization: Bearer vrk_…`. New accounts start in test mode —
nothing texts a real volunteer until a human turns live sends on.

## Protected resource metadata

- Host-level (matches a scan of https://mcp.volunteerreminder.com): https://mcp.volunteerreminder.com/.well-known/oauth-protected-resource
- MCP resource: https://mcp.volunteerreminder.com/.well-known/oauth-protected-resource/mcp
- Authorization server: https://volunteerreminder.com/.well-known/oauth-authorization-server

VolunteerReminder (the web app) is the authorization server. This host is not
an AS.

## Flow 1 — OAuth Allow

1. Add the connector URL `https://mcp.volunteerreminder.com` (endpoint `https://mcp.volunteerreminder.com/mcp`).
2. Register at `https://volunteerreminder.com/oauth/register`, authorize at `https://volunteerreminder.com/oauth/authorize`,
   token at `https://volunteerreminder.com/oauth/token`.
3. Send `Authorization: Bearer vra_…`.

## Flow 2 — API-key bearer

1. Start a trial at https://volunteerreminder.com/signup or with `create_account` (no key returned).
2. Mint a key at https://volunteerreminder.com/account/security.
3. Send `Authorization: Bearer vrk_…`.

## What this host does not implement

- WorkOS agent-auth identity registration, ID-JAG, or claim ceremonies
- A second authorization server
- Google A2A or WebMCP (VolunteerReminder does not speak those protocols)

Docs: https://volunteerreminder.com/docs/agents