What to enter
That’s the whole configuration. Everything else your client needs, it discovers.
Why no credentials
Rippit supports OAuth 2.1 dynamic client registration (RFC 7591). The first time an unrecognized client connects, it registers itself with Rippit’s authorization server and receives its own identity. Nobody has to pre-provision anything. Your client discovers everything it needs from two published documents:https://mcp.rippit.com/.well-known/oauth-protected-resource: identifies the authorization serverhttps://app.rippit.com/.well-known/oauth-authorization-server: endpoints, supported scopes, and the registration endpoint
What your client must support
- Streamable HTTP transport. SSE is deprecated in MCP and not supported.
- OAuth 2.1 authorization code flow with PKCE (S256). PKCE is required for every client.
- Browser-based sign-in. Users authenticate at
app.rippit.com; credentials are never entered into the client.
Expect an “unverified” consent screen
Because these clients identify themselves rather than being vetted by Rippit in advance, the consent screen labels them unverified with self-reported details. It is not an error; it tells the user that Rippit is taking the client’s word for its own name and redirect address. Registration is held for one hour and discarded unless a user completes sign-in, so registering a client grants no access on its own. See Security for the full model.Verifying the server is reachable
401 with a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource is the healthy response, and it’s how a well-behaved client discovers where to sign in.