FitnessPeak

ChatGPT

Honest status: FitnessPeak works with ChatGPT through the API and through Codex. The one-click connector UI expects OAuth, which we do not implement yet.

We would rather tell you this than have you find out. FitnessPeak authenticates with a static bearer key. OpenAI's connector UI is built around an OAuth flow and has no documented field for a fixed Authorization header, and putting a key in the URL instead can get a connector rejected outright. Until we ship OAuth, treat the connector UI as unsupported.

What works today

The Responses API

Pass your key as the authorization field on the MCP tool. This is the documented way to give a remote MCP server a bearer credential:

POST /v1/responses 
{
  "model": "gpt-5",
  "tools": [
    {
      "type": "mcp",
      "server_label": "fitnesspeak",
      "server_url": "https://fitnesspeak.app/mcp",
      "authorization": "fp_live_YOUR_KEY_HERE",
      "require_approval": "never"
    }
  ],
  "input": "How did I sleep this week?"
}

Codex

Codex supports static credentials explicitly — either a bearer token from the environment or literal headers:

~/.codex/config.toml 
[mcp_servers.fitnesspeak]
url = "https://fitnesspeak.app/mcp"
bearer_token_env_var = "FITNESSPEAK_API_KEY"

What does not work yet

  • The connector UI. Settings → Apps → custom connector expects OAuth. A static key has nowhere to go.
  • Key in the URL. Our /mcp/<key> form works in other clients, but OpenAI may reject a connector whose URL carries a credential — reports show a 400 "Connector is not safe". Don't rely on it here.

What we did about it

FitnessPeak is now an OAuth 2.1 authorization server as well as a bearer-key one. /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server both answer, dynamic client registration (RFC 7591) is open, and PKCE is mandatory. A connector that wants to run the OAuth dance can discover everything it needs and do so — nothing to paste.

The key route did not go anywhere. /mcp accepts either credential, so the two-minute paste-a-key setup still works in Claude Code, Cursor, VS Code and Zed. OAuth is the addition, not the replacement.

Meanwhile

If you want a chat interface today, Claude takes a bearer header in Desktop, Code and claude.ai, and setup is one command.