Log inSign up free
  1. Home
  2. Documentation
  3. Authentication

Authentication

How access to MCPTube works: one /mcp address that works without an account and opens the login (OAuth 2.1) when needed, plus API keys for scripts and CI.

MCPTube has one address for MCP clients: https://mcp.mcptube.com/mcp. It works without an account and switches to your account’s plan once you log in. Every way into the same account shares one quota: creating more keys does not raise your limit.

How you call itPlan
/mcp without credentialsAnonymous, with a quota per IP.
/mcp after logging in (OAuth)Your account’s plan: Free or Pro.
/mcp or /v1 with a key in the Authorization headerYour account’s plan.

No login

Without credentials, /mcp answers on the anonymous plan: 5 calls a day, counted per IP, videos up to 480p and 30 minutes, no AI transcription and no API key.

When a request goes beyond the anonymous plan (today’s quota is used up, the video is longer than 30 minutes or it needs AI transcription), the server answers 401 with WWW-Authenticate and your client opens the MCPTube login by itself. This happens at most once a day; other times, the response explains the limit and includes a sign-up link. Resolution above 480p is not refused: the video comes in 480p, with a note.

OAuth login on MCP

This is the way for MCP clients. MCPTube follows the MCP authorization spec:

  1. The client gets 401 with WWW-Authenticate: Bearer resource_metadata="https://mcp.mcptube.com/.well-known/oauth-protected-resource/mcp": when a request goes beyond the anonymous plan, or right away if the address is https://mcp.mcptube.com/mcp?login=1.
  2. It reads the resource metadata and finds the authorization server: https://app.mcptube.com/api/auth.
  3. The client registers itself (Dynamic Client Registration) and opens your browser at app.mcptube.com/login.
  4. You log in with Google, GitHub or email and authorize access. The client gets a token that only works for https://mcp.mcptube.com/mcp, with PKCE (S256).

There’s nothing to copy: just paste the /mcp address into your client. Want your plan from the first call? Paste https://mcp.mcptube.com/mcp?login=1. An invalid or expired token gets 401 and never falls back to the anonymous plan. To disconnect, remove the connector in the client.

API key

For scripts, automations and CI, create a key in the dashboard. The Free plan includes 1 active key and Pro up to 10, each with a name that shows up in your usage history.

Header
Authorization: Bearer mct_YOUR_KEY
  • The full key is shown exactly once, right after you create it. We never store the key itself, only a fingerprint used to check it.
  • With an invalid or revoked key, the response is 401. The call does not fall back to the anonymous plan.
  • Revoking takes effect immediately for every client using the key.