curl --request POST \
--url https://mcp.echozero.app/api/auth/social/url \
--header 'Content-Type: application/json' \
--header 'x-signature: <x-signature>' \
--header 'x-timestamp: <x-timestamp>' \
--data '
{
"type": "GOOGLE",
"fingerprint": "fp_browser_abc123"
}
'{
"success": true,
"data": {
"status": "success",
"url": "<string>",
"errorMessage": "<string>"
}
}{
"success": false,
"error": {
"code": "NOT_FOUND",
"message": "Resource not found"
}
}Generate a social provider OAuth URL
Returns the provider authorization URL the client should redirect the user to. Currently only GOOGLE is accepted. The signed state is stored server-side and must be echoed back to /auth/social/verify.
curl --request POST \
--url https://mcp.echozero.app/api/auth/social/url \
--header 'Content-Type: application/json' \
--header 'x-signature: <x-signature>' \
--header 'x-timestamp: <x-timestamp>' \
--data '
{
"type": "GOOGLE",
"fingerprint": "fp_browser_abc123"
}
'{
"success": true,
"data": {
"status": "success",
"url": "<string>",
"errorMessage": "<string>"
}
}{
"success": false,
"error": {
"code": "NOT_FOUND",
"message": "Resource not found"
}
}Headers
Required for API-key authenticated requests. HMAC-SHA256(secretKey, timestamp + METHOD + path + body) as lowercase hex. Omit only for JWT/OAuth session tokens or public routes.
Required with x-signature. Epoch milliseconds; rejected if drift exceeds 5 minutes. Omit only for JWT/OAuth session tokens or public routes.
Body
OpenAPI schema McpAuthWithSocialBodyDto. Subset of GraphQL AuthWithSocialInput restricted to Google.
Social provider. Only GOOGLE is currently exposed on the MCP REST API.
GOOGLE, FACEBOOK, APPLE, TWITTER, DISCORD, TELEGRAM "GOOGLE"
Device fingerprint / visitor id.
"fp_browser_abc123"
Frontend path the client wants to land on after OAuth verification.
"/dashboard"
Opt-in to marketing offers / communications (applied only if this flow creates a new user).
Promo code (new users only).
Username of the referring user (new users only).
User id of the referring user (new users only).
"507f1f77bcf86cd799439011"