---
title: "Begin the OAuth handshake for an External MCP Connection"
method: GET
path: "/v1/mcp-connections/{connectionId}/connect/start"
tags: ["Authentication"]
---

# Begin the OAuth handshake for an External MCP Connection

`GET /v1/mcp-connections/{connectionId}/connect/start`

Runs RFC 9728 discovery, dynamic client registration if needed, and returns an authorize URL to redirect the admin's browser to.

## Path parameters

- `connectionId` string, typeid, required

## Response `200`

Authorize URL, or already connected.

- ExternalMcpConnectStartResponse
  - `status` 'connected' | 'needs_auth', required
  - `authorizeUrl` string, nullable, required

## Other responses

- `401` — The caller must be signed in.
- `404` — Unknown connection.
- `409` — The OAuth connection requires provider or issuer configuration before connecting.
- `502` — OAuth handshake failed.

---

[API](https://skmtc.net/openworklabs/apis/den-api.md) · [All operations](https://skmtc.net/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openworklabs/den-api/versions/805150503452/schema)