> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firecrawl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Firecrawl MCP with OAuth

> Sign in to Firecrawl through an interactive MCP client without handling an API key.

## Connect with OAuth

OAuth server URL (Streamable HTTP; the client starts browser sign-in): `https://mcp.firecrawl.dev/v2/mcp-oauth`

* ChatGPT: settings > enable Developer mode > Apps & Connectors > Create > Authentication: OAuth > paste the server URL.
* Claude.ai: Settings > Connectors > Add custom connector > paste the server URL, leave Client ID and Secret blank.
* Codex: `codex mcp add firecrawl --url https://mcp.firecrawl.dev/v2/mcp-oauth` then `codex mcp login firecrawl`
* Claude Code: `claude mcp add --transport http firecrawl https://mcp.firecrawl.dev/v2/mcp-oauth` then complete sign-in via `/mcp`
* Cursor or any JSON-config client: `{"mcpServers": {"firecrawl": {"url": "https://mcp.firecrawl.dev/v2/mcp-oauth"}}}`
* OpenCode (`opencode.json`): `{"mcp": {"firecrawl": {"type": "remote", "url": "https://mcp.firecrawl.dev/v2/mcp-oauth", "enabled": true}}}`

A human must complete the browser sign-in and approve a team. Do not open the server URL directly in a browser.

<Note>
  `https://mcp.firecrawl.dev/v2/mcp-oauth` is a server URL for your MCP client. It is not a page to open directly in a browser. Your client starts the browser sign-in flow.
</Note>

Use OAuth when a person is present to sign in, choose a Firecrawl team, and approve access. The client receives tokens for that connection instead of asking you to copy a Firecrawl API key into the conversation.

The sign-in page asks you to choose a team and approve the connection. If the client asks for an OAuth Client ID or Client Secret, leave both blank. Compatible clients identify themselves automatically.

Requests made through this connection use the selected team. You can review or revoke the connection from [MCP settings](https://www.firecrawl.dev/app/settings?tab=mcp).

Need an unattended connection instead? Use the [API-key setup](/mcp-server/keyless-api-key#add-an-api-key). Do not paste the key into an agent conversation or put it in the MCP URL.

## Verify the connection

Start a new client session, then try:

```text theme={null}
Search the web for the latest Firecrawl release notes and summarize the sources.
```

If no Firecrawl tools appear, open the client's MCP status, confirm that `firecrawl` is authenticated, and check that only one Firecrawl server entry is active.

## Switch an existing keyless connection

Update or replace the existing `firecrawl` server with the OAuth server URL. Do not add a second Firecrawl entry. After the change, start a new client session before retrying the request.

### Codex

Run:

```bash theme={null}
codex mcp add firecrawl --url https://mcp.firecrawl.dev/v2/mcp-oauth
codex mcp login firecrawl
```

Codex replaces the existing server with the same name. Enter `/mcp` and confirm that `firecrawl` is connected.

### Claude Code

Claude Code does not overwrite an existing server with the same name. Remove the current entry, then add the OAuth entry:

```bash theme={null}
claude mcp remove firecrawl
claude mcp add --transport http firecrawl https://mcp.firecrawl.dev/v2/mcp-oauth
```

Open `/mcp` in Claude Code and complete the browser sign-in.

### Other clients

Edit the existing `firecrawl` server and set its URL to:

```text theme={null}
https://mcp.firecrawl.dev/v2/mcp-oauth
```

Save the configuration, complete the sign-in started by the client, then open a new client session.

## Compatibility and security details

<AccordionGroup>
  <Accordion title="Compatibility during migration">
    Existing OAuth tokens issued for `/v2/mcp` remain supported there. New interactive connections use `/v2/mcp-oauth`, and tokens issued for that account resource are not accepted by `/v2/mcp`.
  </Accordion>

  <Accordion title="OAuth client and redirect support">
    Firecrawl uses OAuth Authorization Code with PKCE. Compatible clients can identify themselves with a Client ID Metadata Document or Dynamic Client Registration, so they do not need a client secret.

    Firecrawl accepts HTTPS redirect addresses and loopback redirects on `localhost`, `127.0.0.1`, or `[::1]`. For a native client using a loopback redirect, the port may change between runs. The rest of the registered redirect address must match exactly.
  </Accordion>

  <Accordion title="Token scope and lifetime">
    Access tokens expire after one hour. Refresh tokens rotate after a successful refresh. Each connection is bound to its OAuth client, user, team, scope, and MCP resource.

    A new token issued for `/v2/mcp-oauth` is not accepted by `/v2/mcp`. Tokens with a missing or ambiguous audience fail closed.
  </Accordion>

  <Accordion title="Revoke a connection">
    Open **MCP** in [Firecrawl Settings](https://www.firecrawl.dev/app/settings?tab=mcp) and revoke the connection. Revocation invalidates its access and refresh tokens. Reconnect from the client to authorize it again.
  </Accordion>

  <Accordion title="Team billing and access">
    Requests made through a connection consume the credits of the team selected during sign-in, under that team's plan. Each connection is listed in [MCP settings](https://www.firecrawl.dev/app/settings?tab=mcp), where it can be reviewed and revoked at any time. For SSO and organization-wide controls, see [Enterprise](/enterprise).
  </Accordion>
</AccordionGroup>

## More resources

<CardGroup cols={2}>
  <Card title="Compare connection options" icon="shuffle" href="/mcp-server">
    Return to the MCP setup chooser.
  </Card>

  <Card title="Choose a tool" icon="wrench" href="/mcp-server/tools">
    Review the Firecrawl MCP tool surface.
  </Card>
</CardGroup>