Skip to main content
Use Firecrawl’s account endpoint when a person is present to sign in and approve access. The client receives short-lived, resource-bound tokens instead of your raw Firecrawl API key.
The dedicated account endpoint is not live yet and currently returns 404. Until the rollout completes, keep existing OAuth connections on https://mcp.firecrawl.dev/v2/mcp, or use that endpoint without credentials or with an API key in the Authorization header. Do not configure /v2/mcp-oauth yet.

​
Connect

Point a compatible interactive client at:
If the client asks for an OAuth Client ID or Client Secret, leave both blank. Compatible clients identify themselves automatically using Client ID Metadata Documents or Dynamic Client Registration. The client opens Firecrawl in your browser. Sign in, choose the team the connector should use, review the consent request, and approve access. Requests are billed to the selected team. Use the client-specific guides for ChatGPT and Claude, because their setup screens and workspace rules differ.

​
What the two hosted endpoints do

API keys work on either endpoint as Authorization: Bearer <FIRECRAWL_API_KEY>. For unattended clients, prefer an environment-variable-backed Bearer configuration rather than storing the key directly in a project file.

​
Compatibility during rollout

  • Compatible existing OAuth tokens explicitly bound to /v2/mcp continue working on /v2/mcp.
  • During the migration window, a compatible existing token explicitly bound to /v2/mcp can also be accepted by /v2/mcp-oauth.
  • A new token issued for /v2/mcp-oauth is not accepted by /v2/mcp.
  • Tokens with a missing or ambiguous audience fail closed.
  • Existing https://mcp.firecrawl.dev/<API_KEY>/v2/mcp configurations continue working. New configurations should use an OAuth connection or a Bearer header because credentials should not be placed in URLs.
This compatibility is intentionally one-way. It preserves compatible existing connections while keeping newly issued account tokens bound to the dedicated account resource.

​
Security properties

  • Access tokens expire after one hour.
  • Refresh tokens rotate on every successful refresh.
  • Each connection is bound to its OAuth client, user, team, scope, and MCP resource.
  • Connections can be reviewed and revoked independently in Firecrawl settings.
  • OAuth clients use Authorization Code with PKCE and do not need a client secret.

​
Supported standards

  • OAuth 2.0 Authorization Code with PKCE (S256)
  • RFC 8414 Authorization Server Metadata
  • RFC 9728 Protected Resource Metadata
  • Client ID Metadata Documents (CIMD)
  • RFC 7591 Dynamic Client Registration (DCR)
  • RFC 8707 Resource Indicators
Clients discover the authorization server from protected-resource metadata. New account connections must send this exact resource on both authorization and token requests:
The authorization-server metadata is available at: