Skip to main content

Authentication

The server uses OAuth 2.0 Authorization Code with PKCE. Most MCP client libraries handle token generation and refresh automatically once you point them at the server.

Discovery​

The MCP server publishes protected resource metadata (RFC 9728) at its root, and points at Careem Identity as the authorization server:

GET https://mcp.careemapis.com/.well-known/oauth-protected-resource
FieldValue
resourcehttps://mcp.careemapis.com/mcp
authorization_servers["https://identity.careem.com/"]
scopes_supportedopenid, xcma, profile

Then fetch Careem Identity's own discovery document to get its endpoints:

GET https://identity.careem.com/.well-known/openid-configuration

Use the authorization_endpoint (https://identity.careem.com/authorize), token_endpoint (https://identity.careem.com/token) and supported scopes and methods from that document rather than hard-coding them.

info

The OAuth flow runs directly against Careem Identity — the MCP server only publishes the metadata above. Use the client_id issued to you by Careem (request one). Sandbox uses https://mcp.sandbox.careemapis.com/mcp and https://identity.qa.careem-engineering.com/.

The full sequence​

Key points​

  • PKCE is mandatory — only S256 is accepted. Public clients (no secret) are supported.
  • Request offline_access if your integration needs refresh tokens for long-lived sessions.
  • Send the Authorization: Bearer header on every /mcp request — requests without it are rejected.

Redirect / callback URLs​

Your redirect_uri must exactly match one registered for your client. Localhost loopback callbacks for local development (e.g. http://localhost/callback, http://127.0.0.1/callback) are already registered, along with the standard Claude and ChatGPT connector callbacks.

If your integration needs a callback URL that isn't registered, list it when you request a client ID, or contact the Careem MCP team and we'll add it.