---
title: "Begin the OAuth handshake for an External MCP Connection"
method: GET
path: "/v1/mcp-connections/{connectionId}/connect/start"
tags: ["Authentication"]
---

# Begin the OAuth handshake for an External MCP Connection

`GET /v1/mcp-connections/{connectionId}/connect/start`

Runs RFC 9728 discovery, dynamic client registration if needed, and returns an authorize URL to redirect the admin's browser to.

## Path parameters

- `connectionId` string, typeid, required

## Response `200`

Authorize URL, or already connected.

- ExternalMcpConnectStartResponse
  - `status` 'connected' | 'needs_auth', required
  - `authorizeUrl` string, nullable, required

## Other responses

- `401` — The caller must be signed in.
- `404` — Unknown connection.
- `409` — The OAuth connection requires provider or issuer configuration before connecting.
- `502` — OAuth handshake failed.

## Changes

- **2026-08-20** `93df40e2efd5` — 1 info
  - removed the pattern `^emc_.*` from the `path` request parameter `connectionId`

[Change history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/mcp-connections/:connectionId/connect/start/get.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) · [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/openworklabs/den-api/revisions/d3984673ccd1/schema)