Migrate OfflineCreator MCP from API keys to OAuth

Use the current endpoint pair, verified 9 August 2026

OfflineCreator currently documents `https://mcp.offlinecreatorstudio.com/mcp` as the recommended remote MCP endpoint using browser OAuth. The first-party guide still keeps API-key fallbacks available through `@offlinecreator/mcp`: local stdio and the legacy remote host. Live protected-resource metadata for that legacy host identifies `https://offlinecreatorstudio.com/mcp` and advertises header bearer authentication. This migration changes the connection and credential path; it is not evidence of different model quality, prices, tool results, or customer outcomes.

The canonical host's live protected-resource metadata identifies the MCP resource, names its authorization server, and advertises `models`, `read`, and `generate`. Its authorization-server metadata currently publishes authorization, token, registration, and revocation endpoints; authorization-code and refresh-token grants; and S256 PKCE. Recheck those machine-readable documents before changing a fleet because this page follows a monthly freshness cadence.

Recommended remote

https://mcp.offlinecreatorstudio.com/mcpConfigure only the URL, then let a compatible MCP client discover OAuth and open browser sign-in.

Legacy remote fallback

https://offlinecreatorstudio.com/mcpStill documented as the legacy API-key remote; its live metadata supports header bearer methods and points operators to Settings for keys.

Package baseline

@offlinecreator/mcp 0.1.2Recheck the public package record and live metadata before applying this migration.

Separate product instructions from protocol requirements

The first-party setup page and public npm README establish OfflineCreator's current endpoint names, client examples, fallback boundaries, and key-handling instructions. The cited live well-known documents establish what the canonical and legacy hosts advertise now. The MCP specification supplies the independent discovery contract: protected-resource metadata locates the authorization server, and clients carry the canonical resource identifier through authorization and token requests.

These sources do not establish that every MCP client supports the current flow, that a cached client will discard an old header automatically, or that a browser consent screen guarantees tool calls work. No authenticated account, personal API key, access token, refresh token, authorization code, or paid generation was used for this research. Treat a successful connection and low-risk tool calls as the acceptance evidence for your own client.

Product evidence

Setup page and immutable npm releaseUse these for OfflineCreator URLs, configuration shapes, fallback boundaries, and the published tool list.

Live endpoint evidence

Protected-resource and authorization-server metadataUse these for the current resource, issuer, scopes, endpoint URLs, grants, and PKCE method.

Normative evidence

MCP authorization and discovery specificationUse this for client discovery behavior and the resource-indicator requirement, not for OfflineCreator product promises.

Replace the credential-bearing configuration in stages

Start by inventorying every place the old key can enter the client: an `Authorization` header on the legacy remote URL, `OFFLINECREATOR_API_KEY` in a local stdio environment, a shell or process manager, and copied project configuration. Do not paste the old value into the new entry. Add a separate connection whose only required product setting is the canonical remote URL, reload the client, select Connect, and complete Studio sign-in and consent in the browser.

The expected discovery chain is mechanical. An unauthenticated request can receive a 401 challenge, after which the client retrieves protected-resource metadata, selects the advertised authorization server, validates its metadata, and requests a token for the canonical MCP resource. OfflineCreator's current metadata identifies that resource as `https://mcp.offlinecreatorstudio.com/mcp`. If a client instead asks for a fixed header or never opens OAuth, preserve the old connection as a temporary rollback and investigate client support rather than moving the key into a URL.

Verify the new connection before removing the fallback. First confirm tool discovery. Then call `list_models` and `get_credits`, which the published package maps to the `models` and `read` scopes. If the intended workflow includes creation, perform one explicitly approved, low-cost generation only after checking the displayed model and credit cost. Finally revoke the old personal key in Studio Settings and remove its copies from client, shell, CI, and process-manager configuration.

Before

Legacy URL plus Bearer header, or stdio plus environment keyKeep this entry unchanged only while it serves as a bounded rollback.

After

Canonical URL without a copied API keyReload the client and complete the browser authorization flow.

Cutover gate

Discovery, read checks, then an approved generationRevoke the old key only after the OAuth path covers the operations you actually need.

Understand what OAuth changes and what it does not

OfflineCreator's remote OAuth setup removes the need to keep a personal API key in the remote client configuration: the user configures the canonical URL and authorizes named scopes through Studio's browser flow. That configuration change is not evidence that a particular client stores OAuth credentials securely, that every issued token is short-lived, or that compromise becomes impossible.

The generation boundary does not become local. OfflineCreator's first-party guide says MCP and CLI remain interfaces to Studio's cloud service and that generation inputs go to the disclosed cloud provider for the selected model. The same page says OAuth connections can be revoked from Settings. Review the client, Studio grant, and old key as three separate records during cutover; removing a header from one configuration does not prove that every previous copy or token has been invalidated.

Preserve scopes and cloud-provider disclosure

The canonical resource currently advertises `models`, `read`, and `generate`. The public package maps those permissions to distinct operation groups: model discovery; balance, generation status, output, and history reads; and creation, upload, cancellation, and related generation actions. Ask for the scopes the workflow needs, then verify the resulting tool list instead of assuming that an OAuth grant reproduces an unrestricted legacy key.

Changing authentication does not change which model provider processes a generation. The product page says the selected provider and credit cost are shown before generation and that MCP uses the same Studio account balance and published model costs as the web experience. This draft does not independently benchmark those providers or verify a paid run, refund, latency, reliability, output quality, or client-specific consent screen.

models

Catalog visibilityUse `list_models` as the first low-risk discovery check.

read

Balance, status, outputs, and historyUse `get_credits` to confirm the authorized account before creating media.

generate

Creation and generation-changing actionsTest only with explicit approval and a known model cost.

Choose the next page by the boundary you observe

Return to the comparison directory when you are still deciding between access patterns. Use the stdio migration page when local package execution, environment variables, or filesystem upload behavior is the real constraint. Use the authentication troubleshooting path when the canonical URL is present but discovery, consent, token exchange, or scopes fail.

Evidence and editorial boundary

This page owns the staged migration from an OfflineCreator MCP personal API key to the canonical hosted OAuth connection. It does not own general MCP security, client-by-client setup, token-exchange diagnosis, stdio transport migration, or a universal OAuth-versus-API-key comparison. Consolidate it into the comparison directory if current canonical and legacy endpoint behavior can no longer be verified.

The last30days run completed with degraded coverage. X was not configured; Instagram errored; Reddit ended partial after rate limiting; and none of the returned Digg, GitHub, grounding, Hacker News, Reddit, TikTok, or YouTube items substantiated this OfflineCreator migration. Failed or partial sources are missing coverage, not proof that practitioners are silent. No relevant community adoption, compatibility, success-rate, security-outcome, or customer claim is made.