Skip to content
docs
UseBuildChangelog
Open Lumin

Reference

Authentication

Every request to Lumin carries credentials. There is one endpoint and two auth modes. Pick the mode that fits your integration.

Endpoint

Everything goes to https://mcp.lumin.guru/mcp. The server reads the Authorization header and accepts either mode on the same URL.

ModeHeaderUse for
API keyBearer mcp_...Service-to-service, scripting, backend jobs
OAuth 2.1Bearer access tokenPer-user integrations, claude.ai, public clients

API key

Generate a key at app.lumin.guru/api-keys. Keys are prefixed mcp_ followed by a random suffix.

http
Authorization: Bearer mcp_abc123...

You can hold as many keys as you need, one per app or environment, and they all meter against your account's one monthly call allowance, the same one your Claude connector uses. Every tool is available to every key, nothing is gated. Custom limits exist for bigger arrangements, write to contact@lumin.guru. Keys are revocable at any time and do not require client-side rotation logic. Pull a new one and replace.

OAuth 2.1

Lumin exposes standard OAuth 2.1 endpoints:

http
GET  /.well-known/oauth-protected-resource
GET  /.well-known/oauth-protected-resource/mcp
GET  /.well-known/oauth-protected-resource/mcp/auth
GET  /.well-known/oauth-authorization-server
GET  /authorize
POST /token
POST /register

For claude.ai connectors, the discovery flow is automatic. Paste the endpoint URL and Claude will run the consent flow. For custom clients, follow the standard authorization-code-with-PKCE flow against the discovery document.

The server has two endpoints. /mcp takes an API key or an OAuth token, and /mcp/auth takes OAuth only. Each has its own protected resource document, whose resource is that endpoint's URL, path included, and each 401 points at its own. Send that URL back as the resource parameter.

At the sign-in screen the user enters an email address, then a six digit code sent to that address. There is no password step.

A request without credentials returns 401 with a WWW-Authenticate header. Compliant clients read that header and start the flow above, so an unauthenticated first call is the normal way in, not an error to handle.

PreviousComposite workflowsNextError codes