Connect an AI agent to NuriTrip

Last updated: September 2026

How an AI assistant such as Muse connects to the NuriTrip MCP server with OAuth to read and manage your trips. No API key is needed. You sign in with your own NuriTrip account.

Quick start for the agent

1. Discover the auth server. Fetch https://mcp.nuritrip.com/.well-known/oauth-protected-resource. It names the authorization server.
2. Register your client dynamically (RFC 7591). POST to the registration endpoint below. This is a public client using PKCE, so there is no client secret. Never ask the user for a client ID; register one instead.
3. Send the user through OAuth. Open the authorize URL with response_type=code, your registered client_id, code_challenge (PKCE), redirect_uri, scope, and, critically, resource=https://mcp.nuritrip.com (RFC 8707, see the note below). The user signs in with their own email in their phone’s system browser, not inside the chat app.
4. Exchange the code at the token endpoint, requesting the offline_access scope so you get a refresh token. Access tokens last about an hour.
5. Verify. Call tools/list, then nuritrip_list_trips. If trips come back, the connection works.

Configuration reference

Verify it works

After the OAuth flow, make these calls against https://mcp.nuritrip.com:

POST /  {"jsonrpc":"2.0","id":1,"method":"initialize","params":{...}}
POST /  {"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}
POST /  {"jsonrpc":"2.0","id":3,"method":"tools/call",
          "params":{"name":"nuritrip_list_trips","arguments":{}}}

A successful nuritrip_list_trips returns the user’s trips. An empty list with a 200 response means the connection works but the signed-in account has no trips. Check which email was used.

FAQ

Do I need a client ID or API key?

No. Use dynamic client registration (RFC 7591) at the registration endpoint above to mint your own client ID at runtime. Never ask the user to create an app, and never ask them to paste a client ID or secret into chat.

I get 401 "token verification failed".

The token audience, almost certainly. The MCP server requires aud=https://mcp.nuritrip.com. This happens when the authorization request did not include resource=https://mcp.nuritrip.com (RFC 8707). AuthKit then issues a token audience-bound to your client ID instead. Fix the authorize request and reconnect. Reconnecting with the same request will not help.

I get 403 / Cloudflare Error 1010.

Cloudflare in front of mcp.nuritrip.com blocks non-browser User-Agents. Send a browser-like User-Agent header on every request (for example, a current Chrome UA string).

The sign-in page keeps asking for my email or code.

Known issue: AuthKit hands sign-in off to the NuriTrip app’s own login page, which does not always keep a persistent session, so each OAuth attempt re-prompts. Open the sign-in link in the phone’s system browser app (Safari or Chrome), not inside the chat app’s webview. That gives the session the best chance of sticking.

It worked, then stopped after about an hour.

Access tokens live about an hour. You need the offline_access scope to receive a refresh token. If you did not request it, reconnect and include it.

Which email should the user sign in with?

Their own NuriTrip account email. A new or unknown email creates a brand-new empty account with zero trips. If nuritrip_list_trips returns [] on a 200 response, the connection works but it is the wrong account.

Can I reuse this token for other NuriTrip APIs?

No. Tokens are resource-bound to https://mcp.nuritrip.com. Each NuriTrip API is its own OAuth resource with its own .well-known/oauth-protected-resource metadata. Discover and authorize against each one separately.

Does the user need to install or configure anything?

No. The user only completes the OAuth sign-in on the hosted page (ideally in their phone’s browser). Client registration, token handling and API calls are the agent’s job.

If the MCP server's .well-known/oauth-protected-resource names a different authorization server than the one listed here, follow the metadata.