Join the waitlist→

///// AI hosts

MCP sign-in for Gemini CLI

How Gemini CLI signs in to a remote MCP server, the callback it registers, and how to check your server is ready for it.

The callback it registers

http://localhost:51121/oauth/callback

A loopback callback on the user's machine. The port can vary, so your authorization server should accept any loopback port (RFC 8252).

Check your server for it

The anonymous check is the same for every host: it follows the sign-in chain from outside.

On your own server, --register also registers one client per host callback, including this one, and lists each client it created so you can delete them.

The MCP sign-in chain, step by step

The sign-in chain every host follows
AI host
/mcpyour server
  1. 401 challengeWWW-Authenticate: resource_metadata
  2. Protected-resource metadata/.well-known/oauth-protected-resource
  3. Authorization-server metadata/.well-known/oauth-authorization-server
  4. PKCEcode_challenge_methods_supported: S256
  5. Client registrationregistration_endpoint

The host stops here, and nothing looks wrong on your side.