> ## Documentation Index
> Fetch the complete documentation index at: https://leadmagic.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> OAuth authentication for the LeadMagic MCP server

The LeadMagic MCP server uses OAuth. Add `https://mcp.leadmagic.io/mcp` in a compatible AI client, then sign in when the client opens the LeadMagic authorization flow.

## How Authentication Works

Your AI client discovers the protected resource metadata from `mcp.leadmagic.io`, sends you through LeadMagic sign-in, and receives an access token for MCP tool calls.

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
POST https://mcp.leadmagic.io/mcp
Authorization: Bearer <access_token>
Content-Type: application/json
```

> [card] OAuth sign-in
>
> Your client sends you through a LeadMagic authorization flow.

> [card] Bearer tokens
>
> MCP requests use OAuth bearer tokens rather than copied API keys.

> [card] Credit-Based
>
> Each tool call deducts credits from your account balance.

## Connect

**1. Add the MCP server**

Use `https://mcp.leadmagic.io/mcp` as the server URL in your AI client.

**2. Authorize**

Complete the LeadMagic sign-in flow when your AI client prompts you.

**3. Test the connection**

Ask your AI assistant to check your LeadMagic credits.

## Discovery metadata

**Protected resource** `URL`

`https://mcp.leadmagic.io/.well-known/oauth-protected-resource`

**Authorization server** `URL`

`https://mcp.leadmagic.io/.well-known/oauth-authorization-server`

**MCP endpoint** `URL`

`https://mcp.leadmagic.io/mcp`

## Security Best Practices

> [accordion] Do not paste OAuth secrets into docs or chat
>
> OAuth client secrets are shown once when generated. If a secret is exposed, rotate it before using the integration.

> [accordion] Use the OAuth flow when available
>
> Prefer clients that can complete OAuth for remote MCP servers. Avoid static token or header configurations unless your workspace explicitly requires them.

> [accordion] Revoke access if compromised
>
> If an OAuth client or token is exposed, revoke or rotate it from your LeadMagic app settings.

> [accordion] Monitor usage
>
> Check your credit consumption regularly. Use `check_credit_balance` for balance checks, `get_account_analytics` for usage and rate-limit headroom, or visit your [dashboard](https://app.leadmagic.io).

## Authentication Errors

| Error | Cause | Solution |
| - | - | - |
| `401 Unauthorized` | Missing or invalid bearer token | Reconnect the MCP server and complete OAuth sign-in |
| `403 Forbidden` | No credits remaining | [Purchase credits](https://app.leadmagic.io/settings/billing) or check your balance |
| `invalid_token` | Token expired or revoked | Reauthorize the MCP connection |

> [!TIP]
>
> Test your authentication by asking your AI assistant to "check my LeadMagic credits." The `check_credit_balance` tool is free and confirms your connection is working.

## Next Steps

> [card] [Setup Guide](https://leadmagic.io/docs/mcp/setup.md)
>
> Configure your MCP client.

> [card] [Credits & Pricing](https://leadmagic.io/docs/v1/credits.md)
>
> Understand credit costs and manage your balance.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.