MCP authentication and OAuth

MCP connections authenticate with OAuth 2.1 using dynamic client registration over Streamable HTTP. No API key is required.

Endpoint and transport

The MCP server is served over Streamable HTTP at the /mcp path and requires a Bearer token. The Server URL shown in the Developer Console MCP tab is your app origin followed by /mcp.

OAuth flow

The only supported scope is mcp. Authorization uses OAuth 2.1 with dynamic client registration and requires S256 PKCE. The flow uses these endpoints:

• /oauth/register — dynamic client registration

• /oauth/authorize — the consent screen

• /oauth/token — authorization-code and refresh-token exchange

• /oauth/revoke — revoke a connection

• OAuth metadata endpoints

Token lifetimes

Authorization codes expire after 10 minutes and are single-use. Access tokens last 1 hour. Refresh tokens last 90 days when the client supports them and are rotated on refresh.

Revocation

Disconnecting a client or revoking its tokens removes its active connection record immediately.

Errors

Requests without a Bearer token return 401 with "This is an authenticated MCP endpoint. Add this URL to an MCP client; OAuth will start automatically." Invalid or expired tokens return 401 with "The access token is invalid or expired. Reauthorize this MCP server."