ClosedMCP
Browse guides · API reference

API reference

Choose what you want to build. Each example shows the token and request you need.

Choose an API task

Jump to an API step

Base URL: https://closedmcp.com. Use your company’s address if it differs.

An access token lets an AI app call ClosedMCP. A tool identity token tells a connected server who is calling. Use the access token when calling ClosedMCP. Your tool receives a separate identity token to identify the person.

Verify the token

Check the Ed25519 signature with the public key named by kid. Check issuer, audience and expiry. The audience must match your MCP server URL. Then check which companies and actions your service allows.

Open the complete server sign-in guide →

Get public signing keys

GET/.well-known/jwks.json

The public keys for tool identity tokens: one platform key for every company. Pick the key named by kid. Fetch again when a key is unknown.

Authentication: None.

Copy request
Terminal
curl "$BASE/.well-known/jwks.json"
View response
Successful response
{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "use": "sig",
      "kid": "example-key-id",
      "x": "<base64url-public-key>"
    }
  ]
}
Notes and errors

Key values are placeholders. Use the live response to verify signatures.

Errors: No endpoint-specific error response.

Tool identity token fields

A tool identity token is a JWT signed with Ed25519 (alg: EdDSA). Its kid names the key in the public key set.

iss
https://closedmcp.com. The same for every company.
aud
The server this token is for. Must match your MCP server URL (resource).
sub
The person’s stable ClosedMCP id.
email
The person’s work email.
domain
Their company’s domain, confirmed by Google Workspace at sign-in (Google’s hd equals it).
org
Their company’s ClosedMCP workspace.
client
The AI app they use, like Claude, when known. The app names itself, so show it but don’t rely on it for security.
iat, exp
When it was made and when it expires: 5 minutes at most.
jti
A unique id for this token.

ClosedMCP makes a fresh tool identity token for every call. It never sends your MCP server the person’s ClosedMCP key or their Google tokens. Your server receives only the tool identity token.

Tool identity token (decoded)
{
  "iss": "https://closedmcp.com",
  "aud": "https://your-mcp.example.com/mcp",
  "sub": "person-id",
  "email": "person@acme.com",
  "org": "acme",
  "domain": "acme.com",
  "iat": 1700000000,
  "exp": 1700000300,
  "jti": "unique-pass-id",
  "client": "Claude"
}