Reference

Authentication

Every request to Lumin carries credentials. There is one endpoint and two auth modes. Pick the mode that fits your integration.

Endpoint

Everything goes to https://mcp.lumin.guru/mcp. The server reads the Authorization header and accepts either mode on the same URL.

Mode	Header	Use for
API key	Bearer mcp_...	Service-to-service, scripting, backend jobs
OAuth 2.1	Bearer access token	Per-user integrations, claude.ai, public clients

API key

Generate a key at app.lumin.guru/developer. Keys are prefixed mcp_ followed by a random suffix.

http

Authorization: Bearer mcp_abc123...

Every key meters against the monthly call allowance, and every tool is available to every key, nothing is gated. Custom limits exist for bigger arrangements, write to contact@lumin.guru. Keys are revocable at any time and do not require client-side rotation logic. Pull a new one and replace.

OAuth 2.1

Lumin exposes standard OAuth 2.1 endpoints:

http

GET  /.well-known/oauth-protected-resource
GET  /.well-known/oauth-authorization-server
GET  /authorize
POST /token
POST /register

For claude.ai connectors, the discovery flow is automatic. Paste the endpoint URL and Claude will run the consent flow. For custom clients, follow the standard authorization-code-with-PKCE flow against the discovery document.

At the sign-in screen the user enters an email address, then a six digit code sent to that address. There is no password step.

A request without credentials returns 401 with a WWW-Authenticate header. Compliant clients read that header and start the flow above, so an unauthenticated first call is the normal way in, not an error to handle.

PreviousComposite workflows NextError codes