# MCP + OAuth on production (https://energy.tzepchris.com)
## Connector URL
Use this as the **MCP server URL** in ChatGPT or Claude custom connectors:
```text
https://energy.tzepchris.com/api/mcp
```
## Metadata (for clients that discover OAuth automatically)
| Document | URL |
|----------|-----|
| Protected resource | `https://energy.tzepchris.com/.well-known/oauth-protected-resource` |
| Authorization server | `https://energy.tzepchris.com/.well-known/oauth-authorization-server` |
| Human docs | `https://energy.tzepchris.com/docs/mcp` |
Production requires:
- `OAUTH_ISSUER=https://energy.tzepchris.com` (must match the public URL, no trailing slash)
- **Dynamic client registration** (`POST /api/oauth/register`) with **PKCE** (`code_challenge` S256)
- Do **not** rely on the dev client (`wattwise-mcp-dev`) in production — it is only seeded when `NODE_ENV !== production` or `ALLOW_DEV_OAUTH_CLIENT=true`.
Allowed redirect URI hosts: `chatgpt.com`, `claude.ai`, `localhost`, `127.0.0.1`, `cursor.com` (HTTPS required except localhost).
## ChatGPT (custom connector / Apps)
Exact UI labels change between ChatGPT builds. In general:
1. Open **Settings → Apps & Connectors** (or **GPTs → Configure → Actions / Connectors**, depending on your account).
2. **Create** or **Add connector** / **Custom MCP**.
3. Set **MCP URL** to `https://energy.tzepchris.com/api/mcp`.
4. When prompted for OAuth, let ChatGPT use **dynamic registration**, or paste metadata from the authorization-server URL above.
5. Complete login on WattWise when the browser opens (use your WattWise account).
6. Approve scopes: `bills:read`, `analysis:read`, `reminders:read`.
If ChatGPT asks for a redirect URI, it should match `https://chatgpt.com/aip/oauth/callback` (already allowed).
## Claude (custom connector)
1. Open **Settings → Connectors** (or **Developer / MCP**, depending on plan).
2. **Add custom connector**.
3. **Server URL:** `https://energy.tzepchris.com/api/mcp`.
4. Enable OAuth; Claude should discover `registration_endpoint` from metadata.
5. Sign in to WattWise when redirected.
Claude commonly uses `https://claude.ai/api/mcp/auth_callback` as the redirect URI (allowed).
## Manual registration (optional)
```bash
curl -sS -X POST https://energy.tzepchris.com/api/oauth/register \
-H 'Content-Type: application/json' \
-d '{
"client_name": "My ChatGPT connector",
"redirect_uris": ["https://chatgpt.com/aip/oauth/callback"],
"token_endpoint_auth_method": "none"
}'
```
Use the returned `client_id` in the connector setup if the client asks for it. PKCE is still required on authorize/token.
## Chris checklist
1. Set `OAUTH_ISSUER`, `CRON_SECRET`, Postgres `DATABASE_URL`, optional `RESEND_API_KEY` + `EMAIL_FROM`.
2. Deploy `deploy/compose.prod.yml` (app + `wattwise-db` + `wattwise-job-scheduler`).
3. Point Caddy at `wattwise-app:43123` with TLS for `energy.tzepchris.com`.
4. Run `node scripts/e2e-production.mjs --base-url https://energy.tzepchris.com` with `E2E_DELETE_SECRET` matching `CRON_SECRET` or a dedicated secret.
5. Add the MCP connector in ChatGPT and Claude using the URL above.