Sign-in for MCP servers

Add sign-in to your MCP server for $5.99 a month or $55 a year. Your server asks CorroborateMe who the person is, and agents can also call CorroborateMe's own MCP server at /mcp.

When a tool needs to know who the user is

Hold a company API key on the server. When a tool needs a human, create a login link, return loginUrl to the person, and poll until user_id is set. The person signs in on the hosted page with an email code, password, Google, Apple, or a passkey.

Create a login link

This call needs an active Pro plan. Without one it returns 402. POST /api/login-links with the company API key (aa_). Polling and server-sent events work with no extra setup. The default lifetime is 900 seconds.

curl -s -X POST https://corroborateme.com/api/login-links \
  -H "Authorization: Bearer aa_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state":"job-42"}'

The response includes sessionId and loginUrl. Show loginUrl to the person. It opens the hosted sign-in page.

Read who signed in

curl -s https://corroborateme.com/api/login-links/SESSION_ID \
  -H "Authorization: Bearer aa_YOUR_KEY"

Replace SESSION_ID with sessionId from the create call. status is pending, completed, consumed, or expired. user_id (a cu_ id) and email are present after the person finishes, and null while the link is still pending.

To wait instead of polling, open GET /api/login-links/{id}/events. It streams for about 25 seconds and ends with a pending or done event.

Calling CorroborateMe over MCP

CorroborateMe also publishes an MCP endpoint at https://corroborateme.com/mcp (Streamable HTTP). Send Authorization: Bearer and an aa_ key, or an OAuth access token whose audience is that MCP resource. Discovery is at /.well-known/mcp.json and /.well-known/oauth-protected-resource.

{
  "mcpServers": {
    "corroborate-me": {
      "url": "https://corroborateme.com/mcp",
      "headers": {
        "Authorization": "Bearer aa_YOUR_KEY"
      }
    }
  }
}

That JSON shape matches .cursor/mcp.json.example in this product's repo, with the production URL. The tool create_login_link returns sessionId and loginUrl. The tool get_login_status takes session_id (snake case) and returns status, user_id, and email.

Longer setup: authentication for AI agents.