With OAuth you do not copy any secret. Your agent opens an Appfly page, you check what it asks for, and you click Allow. The agent then gets its own access token and renews it by itself.
Use OAuth when you work on your own computer with a client like Claude Code, Cursor, or the Claude app. If your client cannot open a browser, use an API key instead.
Connect your agent
-
Open MCP setup and copy the server address.
-
Add the server in your client without an
Authorizationheader. See the agent setup guide for your agent. -
Start the sign-in in your client. In Claude Code this is
/mcp, then Authenticate. In Cursor and the Claude app it starts when you connect. -
Appfly opens in your browser. If you are not signed in, sign in first. You come back to the same request after that.
-
Read the page, then click Allow.
-
Your browser goes back to your agent. It is connected.
Test it by asking: “Check my Appfly plan and list my apps.”
What you see on the Allow page
The page is called Connect an agent. It shows:
- The name the agent gave itself, for example “Claude Code”.
- The Appfly account it will use, shown as your email.
- What it will be able to do: create and delete apps and files, generate screenshots and videos with AI (which uses your credits), and edit and export your work.
- Where you will be sent back to after you choose.
If you click Deny, your agent gets an access_denied answer and nothing is connected.
How long it lasts
The agent holds two tokens:
- An access token that works for 1 hour.
- A refresh token that works for 30 days. The agent uses it to get a new access token before the old one ends. Each refresh also gives a new refresh token, and the old one stops working.
If the agent is used at least once every 30 days, it stays connected. If it sits unused longer than that, it asks you to sign in again.
See and remove connections
Open Developer API. Under Connected agents you see each agent you allowed, when it connected, and when it was last used.
Click Disconnect to remove one. It stops working at once. The agent can ask you to sign in again later.
Redirect addresses
When a client connects for the first time, it registers itself with Appfly and tells it where to send you back. Appfly accepts:
httpsaddresses.httpaddresses only onlocalhost,127.0.0.1, or[::1]. The port can change each time.- App addresses like
cursor://.
Appfly rejects javascript:, data:, and similar schemes. If a client uses another kind of address, the sign-in page shows “The redirect address does not match the one this app registered” and does not redirect.
If sign-in fails
| What you see | What to do |
|---|---|
| “This app is not registered” | Start the sign-in again from your agent. |
| “The redirect address does not match” | Remove the server from your client and add it again. |
| The agent says the connection expired | Run the sign-in again. Refresh tokens end after 30 days without use. |
| Claude on the web cannot connect | It cannot reach localhost. Use a public address. |
More fixes are in MCP troubleshooting. For the endpoints and the exact flow, see Authentication.