Ship your agent into anything.

[mcp_servers.something_agent]
url = "https://something.cloud/api/mcp"
bearer_token_env_var = "SOMETHING_API_KEY"
enabled = true

claude mcp add --transport http \
  --scope user something-agent \
  https://something.cloud/api/mcp \
  --header "Authorization: Bearer $SOMETHING_API_KEY"

Tools exposed automatically

Request body

{
  "message": "The strongest theme is faster onboarding.",
  "conversation_id": "5f3c9e4a-…",
  "usage": { "input_tokens": 812, "output_tokens": 47 },
  "credits": { "credits": 3, "balance_after": 49872 }
}

Streaming events

Set stream: true and accept text/event-stream. The conversation id arrives first, followed by text, usage and credits, then done.

event: conversation
data: {"conversation_id":"5f3c9e4a-…"}

event: text
data: {"text":"The strongest theme"}

event: credits
data: {"credits":3,"balance_after":49872}

event: done
data: {"stop_reason":"end_turn"}

Embedding with your own JWT

For the hosted agent interface, configure End users → Authentication, mint a short-lived JWT on your server, and pass it as eu_token. The token is captured and removed from the URL on load.

const token = jwt.sign(
  { sub: user.id, email: user.email, name: user.name },
  process.env.AGENT_SIGNING_SECRET,
  { algorithm: "HS256", expiresIn: "1h" },
);

1. Create the OAuth client

In Google Cloud Console → APIs & Services: configure the OAuth consent screen, then Credentials → Create credentials → OAuth client ID → Web application. Leave Authorized JavaScript origins empty — sign-in runs server-side and never calls Google from the browser.

2. Register one redirect URI per environment

Google matches redirect URIs exactly, character for character. Add these under Authorized redirect URIs — the same three however many domains your app is served on, because sign-in always returns through the platform and is then handed back to your app.

production   https://something.cloud/api/end-user-auth/google/callback
staging      https://staging.trysomething.sh/api/end-user-auth/google/callback
development  http://localhost:3000/api/end-user-auth/google/callback

Use a separate client ID and secret per environment. Rotating a staging secret then can’t take production down, and a production credential can never be used from a staging host — the environment is chosen by the callback URL the customer actually arrived on, not by anything the browser sends.

3. Paste the pair into your app

Configure ▸ End users ▸ Google, one card per environment. The client secret is encrypted at rest, is never returned by any read, and never reaches your generated frontend — there is no client-side field for it, by design. Saving a client also switches the app to app accounts, which is what issues the session.

Scopes stay at openid email profile unless you have a reason: every extra scope appears on Google’s consent screen and costs you sign-ups.

4. The button appears by itself

<SignInForm /> renders “Continue with Google” whenever a client is connected for the environment it’s viewed in, and renders nothing extra when there isn’t — so an app set up for production doesn’t show a dead button on staging. Hand-rolling a sign-in screen instead? Use the same hook.

const auth = useEndUserAuth();

{auth.googleEnabled && (
  <GoogleSignInButton onDone={() => setShowAuth(false)} />
)}
{auth.error && <FlowStateCard tone="error" title={auth.error} />}

Google sign-in uses the same accounts as email and password. Someone who signed up with a password and later presses the Google button lands on the same account — linking is by the email address Google has verified — so their history, subscription and data follow them.

Troubleshooting

Customers see a plain sentence, never a code. The codes above appear in your logs and in Check setup on each environment card, which runs the same resolution a live sign-in does and tells you which half is missing.

Retry only requests that are safe for your application. Respect the Retry-After header and add randomized jitter to prevent synchronized retries.