Skip to main content
Glama

Build secureFlows hosted login URL

secureflows_build_login_url

Builds a correct hosted-login redirect URL. Needs no secureFlows token — safe to call at app-scaffolding time, before any user session exists, which is the phase most secureFlows integration mistakes happen in.

Always targets /app/sessions/login (session apps). Never builds the legacy /app/login console URL, which returns a firebaseToken your SecureFlowsCallback handler cannot consume and causes an infinite redirect loop.

Use this instead of hand-building the URL with URLSearchParams — hand-built login URLs are the #1 source of the login-loop and stale-renewal bugs documented in SKILL.md.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
appIdYesApp id from the human prompt ("appId = ...")
intentNofresh_login: normal sign-in, or app-load restore with no prior token (default — almost always correct, including after an explicit sign-out). renew_expired_token: ONLY when resuming the SAME still-intended user after a soft token expiry (401/410) while staying logged in — never after Sign out.fresh_login
originNosecureFlows origin — always https://www.secure-flows.com in productionhttps://www.secure-flows.com
redirectUriYesThe app's unguarded /callback URL, built from the published/allowlisted app origin — never from an iframe or editor chrome origin.
expiredTokenNoThe old sessionToken to renew. Only read when intent=renew_expired_token. Setting this after an explicit sign-out is the "send a dead JWT into hosted login" anti-pattern — it breaks renewal when the underlying identity changed.
workspaceNameYesWorkspace name from the human prompt ("workspace = ...")

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description itself discloses the key behavioral facts: it requires no token, is safe during scaffolding, always targets /app/sessions/login, and never emits the legacy /app/login URL that causes an infinite redirect loop. It also warns against hand-built URLs as a root-cause source of login-loop and stale-renewal bugs, giving the agent real pre-call behavioral knowledge.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five sentences, front-loaded with the core purpose and followed only by high-value context (when safe, which route, why not hand-build). No filler or redundant restatement of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations or output schema, the description plus rich input schema covers invocation phase, safety, target path, and failure modes. The return type is apparent from 'Builds ... URL', and the schema covers all parameters, so nothing an agent needs to select and invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed descriptions, defaults, and enum semantics, so the baseline is 3. The description adds contextual warnings rather than parameter-level detail, which is acceptable because the schema already does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Builds') and precise resource ('hosted-login redirect URL'). It further disambiguates the intended target (/app/sessions/login) from the legacy console URL, so an agent can distinguish this from related login-URL construction alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to call it ('at app-scaffolding time, before any user session exists'), that it needs no token, and directs the agent to use it instead of hand-building with URLSearchParams. It also names the legacy /app/login path as something to avoid, which is a clear exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.