Your goals, in the agent you choose.

Connect with OAuth

Enter this exact HTTPS Streamable HTTP URL in your client's custom MCP connector settings:

https://auth-api.goalifynow.com/mcp

The authorization server is https://auth-api.goalifynow.com/api/auth. Discovery is available at https://auth-api.goalifynow.com/.well-known/oauth-protected-resource/mcp and https://auth-api.goalifynow.com/.well-known/oauth-authorization-server/api/auth. The audience/resource is the complete MCP URL, including /mcp.

1. Create your free GoalifyNow account and finish web onboarding.
2. Add the URL in a compatible client. Use OAuth, authorization code and PKCE S256. Do not paste your password, browser cookie or app JWT into an agent configuration.
3. Sign in on GoalifyNow. Check the account, client identifier, callback and requested permissions before consenting.
4. Start with goalifynow:read. Approve goalifynow:write only when you want requested goal changes. offline_access enables rotating refresh tokens for up to seven days.
5. Run the identity/context tool, then a read. Authorize a write only when you want it, then verify it with a fresh read.

Public clients can register at /api/auth/oauth2/register using token_endpoint_auth_method: none, a name, one to five exact HTTPS or native loopback redirects, and authorization-code/refresh grants. Wildcards, fragments, custom schemes, confidential clients and extra registration fields are rejected. Registration is throttled. CIMD is not enabled in this MVP. Copy the exact callback shown by your client; registered redirects match exactly.

{
  "client_name": "My GoalifyNow agent",
  "redirect_uris": ["http://127.0.0.1:12345/callback"],
  "token_endpoint_auth_method": "none",
  "application_type": "native",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "scope": "goalifynow:read goalifynow:write offline_access"
}

The client must send the exact resource on authorization, token exchange and refresh, retain/validate state and issuer identification, and use a newly generated S256 verifier. Codes expire after 60 seconds and are single-use. Access tokens expire after five minutes. Opaque MCP tokens are checked against the product authorization store on every request; they are not app JWTs.

Seven focused tools

Categories are Fitness, Running, Strength, Weight, Nutrition, Habits and Custom. Names are limited to 200 characters, units to 50, numeric values to 10¹². Unknown input fields are rejected. Tools return minimal structured JSON and links to the app. GoalifyNow has no separate task entity: use a Custom goal with target 1 for an explicitly requested one-step task. No deletes, publishing, payments, access changes, arbitrary HTTP/SQL/shell, or health advice are exposed. The connector adds no paid entitlement; existing plan limits still apply.

{"name":"create_goal","arguments":{
  "name":"Review next week's plan",
  "category":"Custom","metricUnit":"task","targetValue":1,
  "requestId":"b718d209-7304-433f-957f-0f38b7bc4569"
}}

Each requested write needs a stable UUID generated by the client. Reuse it with exactly the same arguments when retrying for 24 hours. A changed request needs a new UUID. Reads have read-only hints; writes are reversible create/update operations with replay protection. Returned goal names are user data, never instructions for the agent.

Try a complete read and write flow

Summarize this week's goals

Use GoalifyNow to confirm my account and read my active goals and habits. Summarize goals due this week and their current progress. Page through results if needed. Do not infer historical activity or give health advice. Do not change anything.

Create a requested task and verify it

Create a GoalifyNow Custom goal named “Review next week's plan”, unit “task”, target 1. Use a fresh request UUID. Then reconnect and read the returned goal ID to confirm it persisted. Show me its app link. Do not mark it complete yet.

After you actually finish it:

Set progress on that exact goal to 1 with a new request UUID, then read it again. Leave every other goal unchanged.

Client recipes and evidence

Checked against primary documentation on 19 October 2026. These recipes do not authorize installing a connector or accepting consent in someone else's account.

ChatGPT

In Plugins, choose the plus action, then Add custom MCP server. Enter the endpoint and OAuth authentication; create/install only in your isolated test workspace. Copy its exact callback URL. Use dynamic registration if offered, or a registered public client. Availability depends on your workspace and client permissions. See OpenAI's custom MCP guide and OAuth requirements.

Codex

codex mcp add goalifynow --url https://auth-api.goalifynow.com/mcp \
  --oauth-client-registration dcr
codex mcp login goalifynow --scopes goalifynow:read
# For a requested write, reconnect with read + write consent.
codex mcp logout goalifynow

Verify syntax with your installed codex mcp add --help; older clients differ. Use the exact callback it displays. Version 0.163.0 discovers the resource automatically; adding the explicit resource flag duplicates it. Logging out removes the local credential; also revoke the server connection in GoalifyNow settings. Official Codex connection guide.

Claude clients and Cowork

Customize → Connectors → Add → Add custom connector. Enter the endpoint and OAuth registration method offered by that client. Hosted Claude documents callback https://claude.ai/api/mcp/auth_callback; use the actual displayed value. Cowork availability is client-specific; a Claude connector recipe is not a live Cowork result. See Claude's setup guide and connector authentication requirements.

Hermes and Grokbot

Hermes documents mcp_servers.goalifynow with url and auth: oauth, then hermes mcp login goalifynow. Confirm its resource and registration behavior before granting access. Hermes MCP documentation. Grok Bot documentation mentions MCP, but an exact interoperable OAuth setup route has not been verified here. Grok web connectors are a different surface.

You control access

Consent identifies your personal GoalifyNow account, the requesting client, callback and scopes. Read-only connections cannot write. Object ownership is checked through the existing API for every tool, including repeat calls. Tokens from another product, browser sessions, expired tokens and tokens for another resource do not grant MCP access.

Open Settings → Agent connections to review and revoke a client. Revocation marks all of that account/client's access and refresh tokens revoked and removes consent; a subsequent connection needs fresh approval. Removing a client locally alone may leave the server grant active. An operation already committed before revocation is not undone.

MCP receives only the requested goal/habit context. It cannot read nutrition logs, photos, body measurements, payments, account administration or other users' records. Your chosen assistant processes tool results under its own data policy. GoalifyNow records bounded tool/principal/scope/outcome/request-ID audit metadata, excluding tokens and private arguments. It does not expose public customer metrics or logs.

Transport uses TLS, maintained OAuth code/PKCE/state mechanisms and an audience-bound opaque token store. The internal API hop uses a separately issued RS256 credential with a dedicated audience and restricted routes; the incoming MCP token is never forwarded. Follow MCP authorization and security guidance.

Limits and safe recovery

Default limits: 30 ingress requests per IP/minute, 120 authenticated requests and tool reads per account/minute, 20 tool writes per account/minute, four concurrent requests, 32 KiB request bodies, 64 KiB results and a 10-second request deadline. OAuth registration allows five requests per IP/minute and 100 per deployment/day. Operators can configure finite values within the documented bounds. Shared atomic Valkey counters and replay markers are namespaced to GoalifyNow; the initial rollout remains one replica.

HTTP 401: reconnect and check the account/resource. 403 or a tool permission error: approve the needed scope or resolve the app's plan/ownership requirement. 404/not-owned: verify the goal ID in your own account. 413: reduce input/page size. 429: wait for Retry-After; tool budget errors include retryAfterSeconds. Unknown methods/tools and schema errors are rejected. After a timeout or pending write outcome, read before retrying; do not generate a fresh request UUID until the outcome is known.

The stateless JSON Streamable HTTP transport uses POST. Authenticated GET and DELETE return 405; there are no persistent transport sessions or server notifications. It negotiates SDK-supported revisions; deployment acceptance must record the exact tested revisions, including the 2025-03-26 and 2025-06-18 baseline. No legacy SSE-only compatibility is claimed. Pagination reports current data; concurrent external app writes may change page contents.

Add one tool safely

1. Choose an existing authorized domain operation. Keep all data access in the product API and resolve the current account on every call.
2. Add strict bounded input/output schemas and a domain-specific tool in mcp/tools.ts. Pick the least read/write scope and accurate hints. Return only needed fields plus an app URL.
3. For a new API path, extend the dedicated MCP credential allowlist deliberately. Never expose a general API proxy.
4. Assign a tool cost, write budget, timeout and result cap. For a reversible write, use the shared 24-hour replay store and owner write serialization. Keep consequential actions out until enforceable preview/confirmation exists.
5. Add real transport/persistence tests plus anonymous, wrong scope/audience, missing account, cross-owner, malformed input, rate/replay and revocation tests. Add deployed acceptance and exact client results before expanding public claims.

The runtime is implemented with pinned @modelcontextprotocol/sdk 1.32.1 and @better-auth/oauth-provider 1.7.9. Product-owned migrations add OAuth tables to the auth database. DeployifyNow owns the serialized infrastructure rollout; product services retain database ownership.