Documentation — OneLinkToken

1. What onelinktoken is

onelinktoken issues, delivers, validates, and revokes short-lived, single-use credentials — magic links, one-time passwords, and bearer tokens — over a REST API, an MCP server, and webhook callbacks. We store a SHA-256 hash of each token value rather than the value itself, so a token can be validated but never read back out of our systems.

It is not an identity provider, a user directory, or a system of record for your users — it is the token layer that sits underneath your own auth: mint a link or code, hand it to a user or an agent, and revoke it the moment you are done with it.

2. REST API basics

Every call is authenticated with a bearer API key and namespaced under /api/v1 on onelinktoken.com. There are three core operations:

POST /api/v1/tokens

Create a magic link, OTP, or bearer token — pass token_type, a target, and an expiry.

POST /api/v1/tokens/redeem

Validate and spend a token once. A redeemed token cannot be reused.

POST /api/v1/tokens/{id}/revoke

Kill a token immediately, whether or not it has been used. Propagates in <100ms.

Status and listing operations are also available — see get_token_status and list_tokens in the MCP tool catalog below for the same operations exposed as MCP tools.

API — Create token

# POST /api/v1/tokens
curl -X POST https://onelinktoken.com/api/v1/tokens \
  -H "Authorization: Bearer tf_key" \
  -H "Content-Type: application/json" \
  -d '{
    "token_type": "magic_link",
    "target_email": "user@hospital.org",
    "expires_in_minutes": 15,
    "max_uses": 1
  }'

# → { "id": "tok_abc", "magic_link_url": "https://onelinktoken.com/r/...", "status": "pending" }

3. MCP tool catalog

Everything the REST API does is also exposed as MCP tools, so an AI agent can discover and call them directly instead of writing an API call. The connector advertises exactly these seven tools:

create_magic_link

Mints a single-use sign-in link for an address, with an expiry you choose.

create_otp

Mints a short numeric one-time password for an email or SMS verification step.

create_bearer_token

Mints an API access token that can be revoked the moment you are done with it.

redeem_token

Spends a token once and reports whether it was valid. A redeemed token cannot be reused.

revoke_token

Kills a token immediately, whether or not it has been used.

get_token_status

Reports the state of one token — pending, redeemed, expired, or revoked.

list_tokens

Lists your recent tokens and their states so you can audit or clean up.

4. Connecting via MCP

Adding onelinktoken as a remote MCP connector to Claude or ChatGPT, the OAuth consent flow, free-tier limits, and — importantly — how to handle the fact that any token minted in a chat ends up in that chat's transcript, are all covered in full on the connect page.

Full MCP connection guide

Endpoint details, step-by-step setup for Claude and ChatGPT, what the OAuth consent screen shows you, and the chat-transcript privacy warning you should read before minting anything sensitive.

Read the connect guide →

5. Self-hosting

There is no hosted signup yet. onelinktoken-server is open and self-hostable: clone the repo, configure it with your own database, cache, and mail provider, and run the API and MCP server on your own infrastructure.

Server repository

Setup instructions, configuration options, and deployment notes live in that repo's own README.

onelinktoken-server on GitHub →

6. Questions

For anything not covered here — integration help, billing, or a security report — see Support.