Hello Therma Authentication

generated: '2026-08-22'
method: probed
source: https://mcp.glaciergrid.com/.well-known/oauth-authorization-server
docs: https://www.glaciergrid.com/connector
summary: >-
  GlacierGrid's only public machine-callable surface — the remote MCP server at
  https://mcp.glaciergrid.com/mcp — is protected by OAuth 2.1 authorization-code flow with
  PKCE, and it publishes both RFC 8414 authorization-server metadata and RFC 9728
  protected-resource metadata. There is no API-key surface, no basic auth, and no
  unauthenticated read path. There is no OpenAPI document to derive securitySchemes from;
  everything below was read from the server's own live metadata.

schemes:
- id: glaciergrid_mcp_oauth
  type: oauth2
  flow: authorization_code
  pkce:
    required_methods:
    - S256
  issuer: https://mcp.glaciergrid.com/
  authorization_endpoint: https://mcp.glaciergrid.com/authorize
  token_endpoint: https://mcp.glaciergrid.com/token
  revocation_endpoint: https://mcp.glaciergrid.com/revoke
  registration_endpoint: https://mcp.glaciergrid.com/register
  grant_types_supported:
  - authorization_code
  - refresh_token
  response_types_supported:
  - code
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - none
  revocation_endpoint_auth_methods_supported:
  - client_secret_post
  scopes_supported:
  - internal
  - customer
  applies_to:
  - https://mcp.glaciergrid.com/mcp
  service_documentation: https://glaciergrid.com/

dynamic_client_registration:
  supported: true
  endpoint: https://mcp.glaciergrid.com/register
  spec: RFC 7591
  evidence: >-
    POST https://mcp.glaciergrid.com/register with an empty JSON body returned 400 (the
    endpoint exists and validates its input) and the endpoint is advertised in the
    authorization-server metadata as registration_endpoint.

challenge:
  status: 401
  header: 'WWW-Authenticate: Bearer resource_metadata="https://mcp.glaciergrid.com/.well-known/oauth-protected-resource/mcp"'
  body: '{"jsonrpc":"2.0","error":{"code":-32001,"message":"Unauthorized: Bearer token required"},"id":null}'
  note: >-
    The 401 carries a resource_metadata pointer, so an MCP client can discover the
    authorization server with no out-of-band configuration. This is the RFC 9728 pattern.

end_user_flow:
  described_at: https://www.glaciergrid.com/connector
  requires:
  - An active GlacierGrid account
  - GlacierGrid login credentials
  identity_provider_note: >-
    GlacierGrid's published subprocessor list names Google (Firebase) for "Identity and
    sign-in" and AWS ElastiCache (Valkey) for "Authorization state only; no facility data".
  identity_provider_source: https://www.glaciergrid.com/subprocessors

not_present:
- api_key
- http_basic
- http_bearer_static
- mutual_tls
- openid_connect_discovery
notes:
- >-
  /.well-known/openid-configuration returns 404 on mcp.glaciergrid.com — the server is an
  OAuth 2.0 authorization server (RFC 8414), not an OpenID Connect provider.