MCP server address — copy exactly
https://identity.lucionglobal.com/mcpThis is a custom remote MCP connection, not an app published in the ChatGPT app directory. ChatGPT plan and workspace rules determine whether custom apps and write tools are available.
| Step | What happens |
|---|---|
| 1. Connect | ChatGPT or Codex opens a browser sign-in with Lucion Identity. |
| 2. Approve | You review each requested permission and approve the assistant's connection. Profile read and API-key creation are independent permissions. |
| 3. Ask | With identity.profile.read, the assistant can read the four basic profile fields. With identity.api_keys.create, it can create an API key only when you request it and specify its read-only permissions and expiry. |
| 4. Store safely | The one-time key appears in the assistant's result and may remain in chat history. Profile reads do not create credentials. Copy it to a trusted secret manager. |
Connect ChatGPT
- In ChatGPT, open Settings and enable Developer mode or custom apps if your plan and workspace administrator allow them. Open the custom-app or connector setup screen.
- Choose to add a remote MCP server, paste exactly https://identity.lucionglobal.com/mcp as the server address, and choose OAuth sign-in. Do not add a final period.
- Let ChatGPT inspect the tool list. Continue to Lucion Identity, sign in if asked, and read the consent page and approve identity.profile.read plus offline_access for profile access. Approve identity.api_keys.create only if you also want the assistant to create API keys on explicit request.
- After approval, return to the chat. Ask ChatGPT to create a key only when you want one; approving the connection does not create a key.
Connect Codex from Terminal
- Open Terminal and add the Lucion MCP server using the standalone command below. Copy only the command inside the code block—especially do not copy a period after /mcp.
- Codex may start its browser sign-in as soon as the server is added. If it saves the server without opening sign-in, run the separate login command below.
- In the browser, sign in to Lucion Identity if needed and approve the displayed permissions yourself. Return to Terminal after the browser reports success.
- To check only this server's saved address without printing other MCP configuration, run codex mcp get lucion-identity. Its URL should end exactly in /mcp.
Add the Codex server — no trailing period and no extra resource flag
codex mcp add lucion-identity --url https://identity.lucionglobal.com/mcpRun this only if adding the server did not start sign-in
codex mcp login lucion-identitySafely inspect only the Lucion server configuration
codex mcp get lucion-identityReplace an incorrectly saved Codex address
codex mcp remove lucion-identity
codex mcp add lucion-identity --url https://identity.lucionglobal.com/mcpCodex derives the OAuth resource (the exact service this connection is allowed to reach) from the MCP server URL. Use the command above as written; do not add a second --oauth-resource value.
Ask for a key
- Tell the assistant the key's label, the smallest read-only permissions it needs, and its expiry. For example: Create a Lucion API key named Calendar reader with calendar.events.read, expiring in 7 days.
- Check the permission names and expiry in the tool request. The OAuth permission identity.api_keys.create lets the connected assistant invoke key creation; the API key's read-only scopes are a separate choice.
| Read-only API-key permission | Allows the key to |
|---|---|
| identity.profile.read | Read permitted basic Lucion ID profile fields. |
| identity.email.read | Read the verified email address and verification state. |
| identity.organization.read | Read organization details available to the identity. |
| identity.organization.members.read | Read permitted organization members. |
| identity.permissions.read | Read permitted authorization context. |
| identity.sessions.read | Read permitted session information. |
| identity.developer.read | Read permitted developer-resource metadata. |
| calendar.events.read | Read calendar events within the granted integration boundary. |
| What happens | Details |
|---|---|
| Sign-in | ChatGPT and Codex are separate clients, so approve each one once. After that, you should not need to sign in for every key request. |
| Connection lifetime | Access tokens last one hour and rotate through refresh tokens for up to 30 days. Expiry, revocation, or a security re-check can require you to connect again. |
| API-key lifetime | Choose 7, 30, or 90 days. The key is stored as a hash and its raw value is shown only once. |
| Disconnect | In Identity Console → Applications, disconnect an assistant to revoke its refresh-token family and linked access tokens. |
| Chat privacy | The raw key is included in the assistant's tool result and may be retained in chat history. Copy it to a trusted password manager or secret manager immediately; do not share the conversation. |
| If this happens | Try this |
|---|---|
| Wrong Lucion Identity service | Check the Codex URL character by character. It must end with /mcp and have no period after it; then remove and add the entry again. |
| Codex says not logged in | Run codex mcp login lucion-identity and complete the Lucion browser approval. |
| ChatGPT cannot add or run the connector | Ask your workspace administrator whether custom MCP apps and write tools are enabled for your account. Availability is controlled by ChatGPT. |
| The assistant does not show the key tool | Reconnect from the exact MCP address above and approve identity.api_keys.create. If available, refresh the tool list after reconnecting. |
| You are asked to sign in again | The refresh grant may have expired or been revoked. Reconnect and review the consent screen again. |