Claude Desktop

Claude Desktop is the one client that needs no credential from you. It registers itself with Vike's authorization server and you approve access in a browser; nothing is copied or pasted.

Add the connector

1. Open Settings → Connectors → Add custom connector
2. Name: Vike
3. URL: https://data.vike.io/mcp
4. Leave the OAuth Client ID and Client Secret fields empty
5. Click Add. A browser tab opens — log into Vike and click Allow
6. The Vike tools appear under the hammer icon in the chat input

Leaving the client id and secret empty is the point, not a shortcut: Claude Desktop calls POST /oauth/register (RFC 7591) and gets its own credentials. Filling those fields in is for a client you registered yourself.

What Vike's authorization server implements

Discovery is standard, so most OAuth-capable clients find everything from the endpoint URL alone:

The Protected Resource Metadata is served by data.vike.io, beside the server, and names https://vike.io as the authorization server, which serves every other row: you sign in on vike.io, and the token it issues is accepted at data.vike.io/mcp.

What the server advertises and enforces:

• Scope — mcp:tools is the only scope, and a registration requesting anything else is refused with invalid_scope.
• Grants — authorization_code and refresh_token. Response type code.
• PKCE — S256 is mandatory and is the only method offered. OAuth 2.1 forbids the plain method and so does this server.
• Token lifetimes — authorization code 10 minutes, access token 1 hour, refresh token 30 days, and a refresh rotates the token.
• Redirect URIs — validated against an allowlist (claude.ai, loopback addresses and a few exact vendor callbacks, listed on Client setup), so a stranger cannot register a client that redirects your approval somewhere else.

Tokens and client secrets are stored as SHA-256 hashes; a plaintext value is returned exactly once, at creation.

Approving, and taking it back

The consent screen requires an authenticated Vike session — if you are signed out, Vike parks the return URL and bounces you through sign-in first, then back to the same consent.

Connected apps are listed under Account → API Keys → Connected Apps, one entry per client. Revoking one revokes every non-revoked token that client holds for your account and leaves your other connected clients alone. The client registration itself is not deleted — reconnecting is a fresh approval, not a re-registration.

⚠ Revocation is not instant. A validated token is cached for 45 seconds, so a revoked token can keep authenticating for that window.

Verify

Search for PEPE token using Vike

calls token_search — 0 credits — and returns matching tokens, which proves the transport, the OAuth token and tool dispatch in one go.

If the hammer icon shows no Vike tools, the connector was added but authorization did not complete; remove it and add it again, watching for the browser tab. If the tools are listed but never used, name one in the prompt — "use the vike token_search tool" — since Claude decides per request whether to reach for a tool.