Sign-in
Sign in
Overdrive signs you in with OAuth. You click Allow. You do not paste a token.
OAuth
Sign-in is OAuth with PKCE and Client ID Metadata Documents (CIMD). There are no static keys.
Do not paste a Bearer token or an API key. Overdrive does not accept static keys for directory use.
Magic link
You sign in with an email magic link. It is not a password, and it is not a Google or SSO login. Overdrive does not have a separate password account. The link is single-use. Claude Connect uses this same path. There is no Allow step that skips the email link.
- Your client opens the Overdrive authorization page.
- Enter your work email.
- Open the link in that email and confirm.
- Click Allow. Overdrive returns you to the client.
Start from the client. A sign-in page opened on its own has nothing to return to.
Tokens
- Access token: 1 hour.
- Refresh token: 14 days, rotating.
Sessions
A session stays valid while the access token can be refreshed. Disconnecting Overdrive in Claude does not end the Overdrive session. There is no /oauth/revoke endpoint, and Overdrive's OAuth metadata lists no revocation endpoint.
Overdrive logout is POST /logout for this sign-in, or POST /logout/all for every session on that sign-in, on https://mcp.useoverdrive.ai. Those routes use the Overdrive sign-in session. After that logout, Overdrive rejects the access and refresh tokens for the ended session, so the next MCP call with the old access token is 401. If Overdrive cannot check its session store, it refuses the call rather than accept the token. Steps are on Troubleshooting.
Logout ends sessions only. It does not delete a pack, prompt content, an access grant, or a usage record. To stop a connection or delete the usage it stored, sign in on Connect and use Turn off or Delete data. What we keep is on Privacy.