# TuraMCP quickstart (5 minutes)

Goal: connect Cursor to the hosted demo MCP with OAuth (no pasted key), or with a PAT for CI.

## Preferred: OAuth (no pasted PAT)

In Cursor MCP settings:

```json
{
  "mcpServers": {
    "turamcp": {
      "url": "https://www.turamcp.com/api/demo-mcp/mcp",
      "auth": {
        "CLIENT_ID": "turamcp-public",
        "scopes": ["mcp"]
      }
    }
  }
}
```

1. Enable the server (or run auth from MCP settings).
2. Cursor should open turamcp.com for email sign-in.
3. Click **Allow**. Cursor stores a short-lived access token.
4. Call `turamcp_whoami` or `turamcp_ping`.

If the browser does not open, check **Output → MCP Logs** for an authorize URL and open it manually. Cursor desktop callback is `http://localhost:8787/callback`.

Static client id `turamcp-public` is pre-registered with Cursor’s fixed redirect URLs (skips Dynamic Client Registration, which is flaky in some Cursor builds).

## TuraLogin product MCP

Manage your TuraLogin account from Cursor/Claude (apps, API keys, activity). Auth is still TuraMCP OAuth; audience is the TuraLogin MCP URL.

```json
{
  "mcpServers": {
    "turalogin": {
      "url": "https://www.turalogin.com/api/turalogin-mcp/mcp",
      "auth": {
        "CLIENT_ID": "turamcp-public",
        "scopes": ["mcp"]
      }
    }
  }
}
```

Tools: `turalogin_whoami`, `turalogin_list_apps`, `turalogin_list_api_keys`, `turalogin_create_api_key`, `turalogin_revoke_api_key`, `turalogin_recent_activity`.

## Alternate: personal access token

1. Open https://www.turamcp.com/login?redirect=/dashboard/mcp
2. Click **Create demo token** and copy the Cursor snippet (includes Bearer header).
3. Paste into Cursor MCP settings.
4. Call `turamcp_whoami`.

Audience for the demo project must be exactly:

```
https://www.turamcp.com/api/demo-mcp/mcp
```

## Validate a token from your server

PATs and OAuth access tokens both work with introspect:

```bash
curl -X POST https://www.turamcp.com/api/mcp/introspect \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"audience":"https://www.turamcp.com/api/demo-mcp/mcp"}'
```

## Your own resource server

1. Require `Authorization: Bearer` on `/mcp`.
2. On 401, return `WWW-Authenticate` with `resource_metadata` pointing at your PRM.
3. PRM lists `https://www.turamcp.com` in `authorization_servers`.
4. Validate JWTs with TuraMCP JWKS; check `aud` matches your MCP URL.

FastAPI + mcp-asgi-http:

```python
auth = JwtAuth(
    issuer="https://www.turamcp.com",
    audience="https://your-mcp.example.com/mcp",
    jwks_url="https://www.turamcp.com/.well-known/jwks.json",
)
app = mount_mcp(api, server, auth=auth)
```

## Revoke

- OAuth: deny at consent, or wait for token expiry; refresh tokens can be rotated/revoked server-side later.
- PAT: Dashboard → Tokens → Revoke.

## Next docs

- [SKILL.md](./SKILL.md)
- [API.md](./API.md)
- [Compare](https://www.turamcp.com/compare)