---
title: "ChatGPT connectors and apps — MCP compatibility"
description: "The strictest of the two big chat hosts on credentials: user-consented OAuth or nothing. Streamable HTTP is required, and ChatGPT prefers a client ID metadata document over dynamic registration."
canonicalUrl: "https://zuplo.com/learn/mcp/compatibility/clients/chatgpt-connectors"
pageType: "mcp-client"
kind: "Hosted connector runtime"
verified: "2026-07-31"
---

# ChatGPT connectors and apps

> The strictest of the two big chat hosts on credentials: user-consented OAuth or nothing. Streamable HTTP is required, and ChatGPT prefers a client ID metadata document over dynamic registration.

_Hosted connector runtime. Protocol revision: Not published._

## Support

- **stdio** — Partial
- **Streamable HTTP** — Yes
- **Legacy HTTP+SSE** — Unknown
- **Protocol revision** — Not published
- **Runs the OAuth flow** — Yes
- **Registration (RFC 7591)** — Yes
- **Metadata document** — Yes
- **Pre-registered client ID** — Yes
- **Sends resource (RFC 8707)** — Yes
- **Validates iss (RFC 9207)** — Unknown
- **Custom headers** — No

**Protocol revision.** Not published, and there's no client source to check. The signals conflict: OpenAI's authorization and tool-annotation pages link `2025-11-25`, while its lifecycle and tool-result pages link `2025-06-18`.

## Caveats and sources

Each one names the column it qualifies and cites the page it comes from, which is often not the page in the row's primary source.

### Custom headers

Stated outright, and it's the most quotable limit in this matrix: ChatGPT doesn't support machine-to-machine OAuth grants such as client credentials, service accounts, or JWT bearer assertions, and it can't present custom API keys or customer-provided mTLS certificates. It does present an OpenAI-managed client certificate of its own, with published CA chains, so mTLS works in one direction only — you can verify ChatGPT, but ChatGPT can't present your certificate.

[Source](https://developers.openai.com/plugins/build/auth)

### Metadata document

ChatGPT prefers a metadata document when one is available, and the builder can choose dynamic registration when both are offered. Its `client_id` is a URL on `chatgpt.com`. For token-endpoint authentication it supports `none` and `private_key_jwt`, preferring the signed assertion where available. Dynamic registration runs once per server connection, and the registered client is reused.

[Source](https://developers.openai.com/plugins/build/auth)

### Sends resource (RFC 8707)

ChatGPT appends `resource` to both the authorization request and the token request. Its redirect URI is on `chatgpt.com`, and OAuth configured without `offline_access` can lose access once the original authorization expires.

[Source](https://developers.openai.com/plugins/build/auth)

### stdio

Not directly. ChatGPT connects to remote servers, and a local stdio or HTTP server reaches it only through the Secure MCP Tunnel, which is gated to enterprise customers.

[Source](https://developers.openai.com/plugins/deploy/connect-chatgpt)

### Legacy HTTP+SSE

OpenAI states the requirement positively — a production endpoint must support Streamable HTTP — without saying SSE is rejected, and one sample on its API docs still shows an SSE transport. Unknown rather than absent until one of those pages says so.

[Source](https://developers.openai.com/plugins/deploy/connect-chatgpt)

### Tool metadata

Full MCP support including write actions is in beta and plan-gated to Business, Enterprise, and Edu, with Pro limited to read and fetch. Tool metadata is also frozen at approval: later changes by the developer don't apply until an admin reviews and publishes an update, and a live server that no longer matches the frozen snapshot can error on tool calls.

[Source](https://help.openai.com/en/articles/12584461-developer-mode-and-mcp-apps-in-chatgpt)

[Primary source](https://developers.openai.com/plugins/build/auth)

_This row was last verified 2026-07-31 against the 2026-07-28 revision._

- **Clients** — [every client in the matrix](/learn/mcp/compatibility/clients)