OAuth for External MCP Servers

Some MCP servers require each user to sign in with their own account. The platform uses the OAuth 2.0 authorization code flow with PKCE (S256). See Connect MCP servers for the server form.

When you need OAuth

Situation	Use
Server accepts one static token for all users	API key
Server has no credentials	None
Server expects a fixed custom header	Custom headers
Each user must grant access to their own data (SharePoint, GitHub, HubSpot, Google Drive)	OAuth

What happens on sign-in

1. In Chat, select Tools. A server that needs a sign-in is listed under Not connected and shows Connect to list actions instead of its actions.
2. Select Connect. A new browser tab opens on the provider's sign-in page. Sign in there and grant access.
3. The tab closes and the server's actions appear in the list. You can now select them.

The sign-in belongs to one user, one server and one browser. Sign in again in every browser you use. Access and refresh tokens stay in your browser, and client secrets stay in backend storage. Chat renews an expired access token when the provider supplies a refresh token, and asks you to sign in again when it cannot. Tool calls use your own token and your own permissions, so you see only what your account may see.

To remove the sign-in from this browser, select Disconnect on the server's row.

Discovery and manual configuration

Leave the authorization and token URLs blank to use discovery. The platform reads the server's protected-resource metadata, selects an authorization server, then reads its metadata for the endpoints, scopes, and registration endpoint.

Configure manually when discovery fails. The precedence:

You fill in	What the platform does
Nothing	Full discovery from the server's metadata
Issuer / discovery URL only	Reads authorization-server metadata from that issuer. Scopes and resource still come from the server's protected-resource metadata
Authorization URL + Token URL	Uses the endpoints exactly as entered without discovery. An issuer URL only enriches dynamic client registration

Fields:

• Client ID — the OAuth application's client ID from the provider. Leave it blank to use dynamic client registration (RFC 7591) when the provider supports it.
• Issuer / discovery URL — the address of the provider's OAuth metadata. Fill it in when the platform cannot find the right authorization server on its own. Leave it blank in most cases.
• Client authentication — how the platform sends the client secret to the provider. Select Public client or automatic registration when there is no secret, Client secret (request body) for most providers, or Client secret (HTTP Basic) when the provider asks for it.
• Client secret — the secret of the OAuth application. Required when you select a client authentication method. The platform stores it and never shows it again.
• Scopes — sent as the scope parameter. Leave blank to use the scopes the server advertises.
• Resource / audience — sent as the OAuth resource parameter. Leave it and Scopes blank to use the server URL.

When you configure Scopes, the platform does not send a discovered resource parameter. Some providers, including Microsoft, reject requests with both values. Leave the resource blank unless the provider requires it.

Dynamic client registration

If the client ID is left blank and the provider supports dynamic client registration, the platform registers the OAuth client automatically. Providers that support RFC 7591 need no application setup.

Troubleshooting

Symptom	Cause and fix
invalid_client at the provider	Verify the client ID and client secret
Discovery finds endpoints but sign-in fails	Endpoint metadata and your OAuth application disagree. Verify the client ID, redirect URI, and that the application is allowed for the expected grant type
Login succeeds but tool calls return 401	The token audience is wrong. Check the Resource / audience field and the provider's expected audience
Chat reports that the OAuth tab was blocked	The browser stopped the new tab. Allow pop-up windows for the Chat address, then select Connect again
Chat connects but reports no tools	The sign-in worked, but the account you signed in with has no access to the server's content. Check the account, then select Connect again

For browser-specific failures, see Connect MCP servers. API callers send the token themselves; see Call tools on the MCP endpoint. For Microsoft setup and errors, see Connect SharePoint.