Connect an AI assistant

Use an MCP client that supports Streamable HTTP and either pre-registered OAuth with PKCE or a configured bearer token. Client support varies; automatic client registration is not available.

MCP server URL

https://api.remotegymp.com/mcp

For Self-Hosted, use the same MCP path on your installation's public HTTPS address. Your client must be able to reach it. The Cloud address does not proxy requests to your installation.

Connect with OAuth

In Settings, create a credential with MCP enabled and only the permissions the assistant needs. Register the exact callback URL supplied by your client. Use the credential username as the OAuth client ID. This flow does not use a client secret.
Callbacks must use HTTPS, or HTTP on an explicit loopback address. The full URL must match, including the port. To change it, create a new credential and revoke the old one.
Connect from your client, sign in as the Owner who created the credential and review the consent screen. The client must use S256 PKCE and the MCP resource URL. Consent can narrow the credential's permissions; it cannot add permissions.

Cloud OAuth endpoints

Authorisation: https://app.remotegymp.com/integration/oauth/authorize
Token exchange: https://app.remotegymp.com/integration/oauth/token
Authorisation server metadata: https://app.remotegymp.com/.well-known/oauth-authorization-server
Protected resource metadata: https://api.remotegymp.com/.well-known/oauth-protected-resource/mcp

OAuth uses standard token field names and rotating refresh tokens. The client should handle refresh automatically. Access tokens last at most 30 minutes. Connections expire after seven days without refresh or 30 days in total. Reusing an old refresh token invalidates the connection; reconnect instead of replaying it.

Connect with a bearer token

If your client supports a configured bearer token, exchange an MCP-enabled credential at the token endpoint with the MCP audience, then put the returned token in the client's secure bearer-token setting. It expires after 30 minutes. Do not put a token in the server URL. Use OAuth for clients that need automatic refresh.

{
  "username": "<your-credential-username>",
  "password": "<your-credential-secret>",
  "audience": "mcp"
}

Authentication →

Check access before doing work

Ask the client to list its available tools and read capabilities first. Start with a read-only request, such as listing devices. An absent tool may reflect permissions, scope or availability. Enabling MCP alone does not grant remote control.

tools/list · get_capabilities

Screen viewing follows device consent. Screen input needs a fresh screenshot. Review targets, deletion previews and quoted AI costs before approving work. The emergency stop blocks further automation; work already running may finish.

Disconnect or revoke access

Disconnect in your client and revoke the credential in Settings when it is no longer needed. Revocation stops its associated tokens and OAuth connections on subsequent requests. Never share the credential between unrelated integrations.