---
title: "Authenticate VolunteerReminder"
description: "How Claude, ChatGPT, Grok, and Cursor-style clients sign in to VolunteerReminder: OAuth Allow, or a pasted vrk_ API key."
canonical_url: https://volunteerreminder.com/auth
md_url: https://volunteerreminder.com/auth.md
last_updated: 2026-08-23
---
# VolunteerReminder authentication

VolunteerReminder lets an AI assistant start a free trial, import a volunteer
roster, and preview upcoming shifts. New accounts start in test mode — nothing
texts a real volunteer until a human turns live sends on from the dashboard.

This file describes the two credential paths VolunteerReminder actually
implements. Protected-resource metadata is the machine-readable source of
truth; this page is the prose companion.

## Protected resource metadata

- Host-level (matches a scan of https://volunteerreminder.com): https://volunteerreminder.com/.well-known/oauth-protected-resource
- REST v1 resource: https://volunteerreminder.com/.well-known/oauth-protected-resource/api/v1
- MCP resource: https://mcp.volunteerreminder.com/.well-known/oauth-protected-resource/mcp
- Authorization server metadata: https://volunteerreminder.com/.well-known/oauth-authorization-server

VolunteerReminder is the authorization server. There is no separate AS host.

## Flow 1 — OAuth Allow (Claude, ChatGPT, Grok)

Use this when the client speaks OAuth 2.1 authorization code + PKCE.

1. Add the connector URL `https://mcp.volunteerreminder.com` (Streamable HTTP endpoint: `https://mcp.volunteerreminder.com/mcp`).
2. The client reads RFC 9728, then RFC 8414, and registers at
   `https://volunteerreminder.com/oauth/register` (RFC 7591 public client).
3. The coordinator signs in with the existing VolunteerReminder session
   (magic link or already signed in) at `https://volunteerreminder.com/oauth/authorize`.
4. The Allow screen lists what the app can access. After Allow, the client
   exchanges the code at `https://volunteerreminder.com/oauth/token` for a short-lived `vra_`
   access token.
5. Send `Authorization: Bearer vra_…` on MCP and REST v1 calls.

No `vrk_` paste on this path.

## Flow 2 — API-key bearer (Cursor-style / scripts)

Use this when the client cannot complete the Allow screen.

1. Start a trial at https://volunteerreminder.com/signup or with the `create_account` MCP tool.
   `create_account` emails a verification link and does **not** return a key.
2. After the coordinator is signed in, mint a key at https://volunteerreminder.com/account/security.
3. Send `Authorization: Bearer vrk_…` on MCP and REST v1 calls.

Never put a raw `vrk_` key in a browser URL.

## Scopes

| Scope | What it allows |
| --- | --- |
| `read` | Read the account, schedules, contacts, and reminder settings |
| `schedules:write` | Create and update schedules |
| `contacts:write` | Create and update the volunteer roster |
| `reminders:write` | Configure reminder rules and send a test to the account owner |

OAuth connectors receive those four scopes. `keys:manage` is not in the
default grant; mint or revoke keys from Account → Security.

## What VolunteerReminder does not implement

- WorkOS agent-auth identity registration, ID-JAG, or claim ceremonies
- A second authorization server
- Live SMS from an agent. Import and setup stay in test mode. A human turns
  live sends on from the dashboard. Do not flip Sharing Bread flags.

## Links

- Docs: https://volunteerreminder.com/docs/agents
- OpenAPI: https://volunteerreminder.com/api/v1/openapi.json
- Pricing: https://volunteerreminder.com/pricing
- Privacy: https://volunteerreminder.com/privacy
- Terms: https://volunteerreminder.com/terms
- Contact: info@volunteerreminder.com

## Sitemap

See the full [sitemap](https://volunteerreminder.com/sitemap.md) for every public page.