> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Authenticate an already-registered server > Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first. For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript. `as_service: true` connects the tenant's shared service account rather than the calling user, which is what a server needs before it can be published, and requires an organization admin. ## OpenAPI ````yaml /api-reference/openapi.yaml post /api/registry/v1/servers/{server_id}/connect openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/registry/v1/servers/{server_id}/connect: post: tags: - registry summary: Authenticate an already-registered server description: >- Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first. For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript. `as_service: true` connects the tenant's shared service account rather than the calling user, which is what a server needs before it can be published, and requires an organization admin. operationId: connect_mcp_server parameters: - name: server_id in: path required: true schema: type: string title: Server Id - name: return_url in: query required: false schema: anyOf: - type: string - type: 'null' description: >- Optional return URL for redirecting the user after connection completes. title: Return Url description: >- Optional return URL for redirecting the user after connection completes. - name: scopes in: query required: false schema: anyOf: - type: string - type: 'null' description: >- Optional space-delimited runtime scope override for the OAuth auth URL. Precedence is: query scopes > server resolved scopes > directory fallback. title: Scopes description: >- Optional space-delimited runtime scope override for the OAuth auth URL. Precedence is: query scopes > server resolved scopes > directory fallback. - name: as_service in: query required: false schema: type: boolean default: false title: As Service requestBody: content: application/json: schema: anyOf: - $ref: '#/components/schemas/CredentialsPayload' - type: 'null' description: >- Credentials for non-OAuth providers (api_key, bearer_token, basic_auth, generic). Not required for OAuth providers. title: Credentials responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ConnectionInitiateResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: CredentialsPayload: properties: api_key: anyOf: - type: string - type: 'null' title: Api Key token: anyOf: - type: string - type: 'null' title: Token bearer_token: anyOf: - type: string - type: 'null' title: Bearer Token username: anyOf: - type: string - type: 'null' title: Username password: anyOf: - type: string - type: 'null' title: Password additional_fields: anyOf: - additionalProperties: true type: object - type: 'null' title: Additional Fields type: object title: CredentialsPayload description: Payload for providing credentials during connection setup. ConnectionInitiateResponse: properties: connection_id: type: string title: Connection Id auth_url: anyOf: - type: string - type: 'null' title: Auth Url state: type: string title: State message: type: string title: Message type: object required: - connection_id - state - message title: ConnectionInitiateResponse description: Response model after initiating a connection. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.