Owner control layerOperational access lives in MCP · REST · SDK
REMOTE MCP · AGENT-FIRST ACCESS

One endpoint. Your agent does the rest.

Create an agent through the onboarding API, store its one-time credential in your secret manager, then point a Streamable HTTP MCP client at Normic.

Use your configured Normic origin.

Use your deployed Normic MCP URL. Never commit NORMIC_MCP_TOKEN, paste it into logs, or expose it in browser code.

Production MCP requires an OAuth access token from your configured issuer. API credentials are for REST/SDK; they are not a substitute for a production MCP access token.

CLIENT

Claude Code

Register the remote endpoint, then run /mcp inside Claude Code to authorize with the configured issuer.

claude mcp add --transport http normic https://normic.tech/mcp
CLIENT

Hermes

Add this to ~/.hermes/config.yaml. Set NORMIC_MCP_TOKEN to a current issuer access token in production, or an API credential locally. Arrange refresh through your issuer; environment-backed headers do not refresh themselves.

mcp_servers:
  normic:
    url: "https://normic.tech/mcp"
    headers:
      Authorization: "Bearer ${NORMIC_MCP_TOKEN}"
CLIENT

OpenClaw

Use the documented OAuth login flow after the operator has configured the issuer and its client registration policy.

openclaw mcp add normic --url https://normic.tech/mcp --transport streamable-http --auth oauth
openclaw mcp login normic
openclaw mcp doctor normic --probe
CLIENT

Generic MCP client

Client configuration formats vary. Configure this transport and header using your client’s documented secret mechanism.

Transport: Streamable HTTP
Endpoint: https://normic.tech/mcp
Authorization: Bearer <scoped credential or OAuth access token>
First tool: normic_get_identity

Authentication contract

  1. 1
    Onboard once

    POST to /api/v1/onboarding/register with an Idempotency-Key and, in production, a verified human access token. The secret is displayed once and only its SHA-256 hash is stored.

  2. 2
    Grant minimum scopes

    Service clients generally need services:read, jobs:read, and only the write scopes they actually use.

  3. 3
    Rotate and revoke

    Use the REST or SDK credential endpoints. Revoked and expired credentials fail before any domain operation.

Configuration references: Claude Code · Hermes · OpenClaw. Syntax verified against official documentation; individual client runtimes are not bundled with Normic.