NOWADAYS ApparelMagic MCP OAuth Proxy

This service connects ChatGPT to the ApparelMagic MCP endpoint without exposing the ApparelMagic API key to the client. It provides an OAuth 2.0 authorization-code flow with PKCE, validates short-lived bearer tokens, and forwards authenticated MCP requests to ApparelMagic with the configured X-API-Key header.

How it works

1. ChatGPT discovers the OAuth and protected-resource metadata.

2. The MCP client dynamically registers its redirect URI.

3. An administrator authorizes access with the configured password.

4. The client exchanges the one-time authorization code and PKCE verifier for an access token.

5. Requests to /mcp are authenticated and proxied to ApparelMagic.

The ApparelMagic API key remains server-side throughout this flow.

Related MCP server: lighthouse-mcp-oauth

Requirements

• Node.js 20 or newer

• A public HTTPS URL for the deployed service

• An ApparelMagic API key

Installation

Install the exact dependency versions recorded in package-lock.json:

npm ci

Configuration

Set these environment variables in the deployment platform. Never commit their values.

* Set either PUBLIC_BASE_URL or RENDER_EXTERNAL_URL.

Generate strong secrets locally, for example:

openssl rand -base64 48

Run locally

OAuth redirect URIs may use HTTP only for localhost; production deployments must use HTTPS.

export PUBLIC_BASE_URL=http://localhost:3000
export APPARELMAGIC_API_KEY=replace-me
export OAUTH_ADMIN_PASSWORD=replace-me
export JWT_SECRET=replace-with-a-long-random-secret
npm start

Verify the service:

curl http://localhost:3000/health

Expected response:

{"ok":true,"service":"nowadays-apparelmagic-mcp"}

Connect an MCP client

After deployment, configure the MCP server URL as:

https://your-service.example/mcp

The client can discover OAuth configuration through:

• /.well-known/oauth-authorization-server

• /.well-known/openid-configuration

• /.well-known/oauth-protected-resource

• /.well-known/oauth-protected-resource/mcp

On first connection, complete the authorization page using OAUTH_ADMIN_PASSWORD.

Endpoints

Security notes

• Store all secrets only in the deployment platform's secret manager.

• Use a unique, high-entropy JWT_SECRET and rotate it if exposure is suspected.

• Keep OAUTH_ADMIN_PASSWORD separate from the ApparelMagic API key.

• Use HTTPS in production and restrict access to trusted users.

• The default scope is read-oriented, but actual capabilities also depend on the upstream ApparelMagic account and API key.

• Authorization-code replay protection is held in memory. Restarting the service clears that short-lived state, and horizontal scaling would require a shared store.

Development and CI

Run the same checks used by GitHub Actions:

npm ci
npm run check

The CI workflow runs on pushes to main and on pull requests using Node.js 20. Dependabot alerts and normal dependency updates should keep package-lock.json synchronized with package.json.

License

Private NOWADAYS integration. No license is granted for redistribution unless one is added explicitly.