> ## Documentation Index
> Fetch the complete documentation index at: https://context7-ctx7-1886-lazy-auth-support.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up OAuth

> Authenticate with Context7 MCP server using OAuth 2.0

<Note>
  OAuth is only available for remote HTTP connections. For local MCP connections using stdio
  transport, use [API key authentication](/howto/api-keys) instead.
</Note>

Context7 MCP server supports OAuth 2.0 authentication for MCP clients that implement the [MCP OAuth specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization).

## Why Use OAuth?

| Feature                    | OAuth | API Keys |
| -------------------------- | ----- | -------- |
| No manual key management   | ✅     | ❌        |
| Automatic token refresh    | ✅     | ❌        |
| Works with stdio transport | ❌     | ✅        |

## Two Endpoints

| Endpoint     | Behaviour                                                    |
| ------------ | ------------------------------------------------------------ |
| `/mcp`       | Asks you to sign in when your client first connects          |
| `/mcp/oauth` | Same, and always enforced regardless of server configuration |

Both endpoints ask for sign-in up front. That is deliberate: MCP clients run the OAuth
flow natively at connect time, so you get your editor's own sign-in prompt instead of a
failed request part-way through a conversation.

Self-hosted deployments can set `CONTEXT7_MCP_AUTH_MODE=lazy` on the MCP server to let
anonymous callers connect and spend their free monthly requests before being asked to
sign in. That trades a natively handled prompt for a frictionless trial.

```diff theme={null}
- "url": "https://mcp.context7.com/mcp"
+ "url": "https://mcp.context7.com/mcp/oauth"
```

## How It Works

1. Your MCP client connects and receives an OAuth challenge pointing at Context7
2. Your client shows a sign-in prompt or an authorization link
3. You're redirected to Context7 to sign in
4. After signing in, your client stores the token and connects
5. Your client automatically handles token refresh from then on

In `lazy` mode the challenge arrives later — on the tool call that crosses your free
monthly limit — and steps 2 to 5 are otherwise identical.

<Warning>
  **Some clients need you to start the sign-in yourself.** Whether the OAuth flow opens on its own depends on the client, not on Context7. Claude, Claude Desktop and ChatGPT show an inline connect prompt and retry the call once you finish. Terminal clients generally do not: in Claude Code run `/mcp`, select the server and choose "Authenticate"; in Codex CLI run `codex mcp login <server-name>`.
</Warning>

## Client Support

OAuth authentication requires your MCP client to support the [MCP OAuth specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization). If your client doesn't support OAuth, use [API key authentication](/howto/api-keys) instead — an API key raises your limit the same way signing in does, and works on both endpoints.