Authentication

Two ways to connect

• Signing in, for your tool through the connector at https://www.gogoportal.io/mcp. It sends you to a GoGoPortal page where you allow it and set what it may do. There is no code to copy.
• A connect code, for the local connector or a script that calls the API. The code is swapped once for the connection’s key.

Either way it is a connection, with its own switches, limits and call log. You can have up to 10 connections that are not revoked; make one per tool or script, so each has its own limits and its own log.

Signing in

Your tool finds where to sign in from the connector’s answer, and opens the page for you. Signed in, you see which program is asking and the address it sends you back to, and you choose a connection: one your tool signed in with before, or a new one with its name, switches and limits. Allow it, and your tool gets a one-time code it swaps for its tokens. Until it does, your API page shows the connection as not signed in yet, and you can delete it there.

For developers, it is OAuth 2.1 as the Model Context Protocol asks: PKCE with S256, the resource’s metadata at /.well-known/oauth-protected-resource/mcp and the server’s at /.well-known/oauth-authorization-server, and a client known by its metadata document’s address or registered at /oauth/register. The access token (gpo_…) lasts 1 hour and the refresh token (gpr_…) 60 days. The site keeps only their hashes. Each refresh replaces both. The refresh token it replaced is taken once more within 2 minutes, for two refreshes at the same moment; used after that, every token of that sign-in stops working, and your tool signs in again.

The access token works only at https://www.gogoportal.io/mcp. The API at /api/v1 answers it with 401 unauthenticated: your own software uses a connection’s key.

A connect code and its key

Signed in, make a connection on the connect page. The site gives you a connect code, such as GGP-7K2M-9QXT, in a line of text to send to your tool. The code works once, for 15 minutes. Your tool follows the instructions at /connect/agent/local, and the local connector swaps the code for the connection’s key (POST /connections/claim, which needs no key). The key starts with gpc_ and is saved in a file in your home folder, at ~/.gogoportal/<site>/key. On macOS and Linux the connector sets it so other accounts on your computer can’t open it; on Windows it keeps your home folder’s own permissions. The site doesn’t show it. It keeps only a hash of it, which can’t be turned back into the key. When the code is used you get a notice, so you know it was your tool.

When a code didn’t work

A code is not renewed. If yours ran out of its 15 minutes, or didn’t work, delete that connection on your API page and make a new one at Connect: it comes with its own code. Once a code has been used, the connection can’t be deleted; if you think its key is no longer private, revoke it there and make a new one. A revoked connection stays revoked, and its log stays on its page.

Using a key

Send it on every request as Authorization: Bearer <key>. For your own software, run the local connector’s connect command once and read the key from its file, or set GOGOPORTAL_KEY, which the connector uses instead of the file. The API never reads a browser session, so a key works only from your tool or your own software; keep it out of web pages and settings files that get committed. A key also works at the connector’s address. Downloads of result files use signed links that need no key.

What a connection can and cannot do

A connection, signed in or by key, does what its switches allow (see limits and approvals). It can never approve a call, sign off a shared project, change a switch or a limit, withdraw a shared project, answer the questions about who owns material, or delete a session. Those are on your own signed-in pages.

The call log

Every request a connection makes is logged where you can read it, refused ones included, with the bytes it sent and received. The log is kept 90 days.

Revoking

Revoke a connection on your API page and its key, its tokens and any unused code stop working at once; approvals it was waiting for are declined. Connections on a suspended account stop working.