--- title: MCP Authentication for your MCP server | PropelAuth description: Add OAuth 2.1 login, consent, scopes and tokens to your MCP server. CIMD and dynamic client registration, org-scoped permissions, enterprise SSO and a dedicated audit log. canonical_url: https://www.propelauth.com/mcp-authentication --- # Authentication for your MCP server Your users are connecting Claude, ChatGPT and Cursor to your product. PropelAuth handles the login, the consent screen, the scopes and the tokens, so your MCP server only has to implement tools. ## From a 401 to a scoped token An OAuth 2.1 authorization server for the MCP server you build, behind the same login as the rest of your product. 1. **The client finds you.** Your server answers with a 401, and the AI client follows the metadata to PropelAuth and registers itself. 2. **Your user logs in.** Password, magic link, social login or their company's SSO, with whatever MFA policy comes with it. 3. **They decide what the agent can do.** The consent screen names who is asking and each scope in plain language, and their role sets what they can grant. 4. **Your server checks the token.** One introspection call returns the user, organization, roles and granted scopes, and your tools enforce from there. ## Everything the security review will ask about ### Org scopes, gated by role Assign each org scope to the roles that may grant it. An Admin can hand an agent a sensitive scope, a Member sees it grayed out, and your customer's roles set the policy for AI access. _Mockup of the Org Scopes settings: three scopes, each assigned to the roles that may grant them, beside a consent screen where the scopes a Member cannot grant are grayed out_ ### Enterprise SSO, already handled When your customer's employees sign in through Okta or Entra ID, so do their AI clients. An employee deactivated there can't connect a new client or re-authenticate. _Image showing a user selecting one of our SAML guides_ ### Consent that resists phishing A client is identified by its domain, not the name it gives itself. Unknown publishers get a badge and no logo, and local apps get a warning that names the client and the port. _Mockup of the hosted consent screen for an app calling itself Claude Code, marked Unknown publisher with no logo, with a warning that the user will return to an app on their computer, alternating with the same screen for claude.ai marked Recognized_ ### Works with any AI client Your users connect Claude, ChatGPT, Cursor or whatever ships next month, and the client registers itself. CIMD and DCR are both built in, and CIMD clients need no allowlist entry. _Mockup of the setting How do users create OAuth clients, with Client ID Metadata Document, Dynamic Client Registration and hosted pages switched on, and claude.ai's identity document being fetched, verified and marked Recognized_ ### A dedicated MCP audit log Every client created, updated or deleted, and every consent granted or revoked. When a security team asks who connected what, you have the answer. _Mockup of the MCP audit log: filters for client, event type, date and actor above rows for consent granted, client created and consent revoked, each with the client and the actor_ ### Legacy clients, same rules Some clients still run plain OAuth 2.0 and never say which server a token is for. Default Resource fills in yours, so their tokens stay audience-bound. _Mockup of two authorize requests: one from Claude with a resource parameter, one from Copilot Studio without, and the Default Resource setting filling in the missing MCP server address so both tokens carry the same audience_ ## Frequently asked questions ### What is MCP authentication? MCP (Model Context Protocol) is a standard for connecting AI applications like Claude, ChatGPT and Cursor to external systems. When your MCP server runs in your infrastructure, it has to know which user each tool call is for. MCP authentication answers that with OAuth 2.1: the client sends the user to log in and consent, then presents an access token that your server validates on every call. PropelAuth is the authorization server in that flow. This is different from the PropelAuth Integration MCP Server, which is a server your coding agent connects to so it can integrate PropelAuth into your codebase. ### How do I add authentication to my MCP server? Turn MCP Authentication on for an environment in the PropelAuth dashboard and you get an OAuth 2.1 authorization server at your auth URL under /oauth/2.1. Your MCP server points clients at it through its protected resource metadata and validates each access token with one call to the standard token introspection endpoint, using the Request Validation credentials from the dashboard. A valid token comes back with the user, the scopes they granted, and for org scopes their organization, roles and permissions. FastMCP has a built-in PropelAuthProvider, and any framework can make the same call. ### Do you support Dynamic Client Registration (DCR) and Client ID Metadata Documents (CIMD)? Yes, both. Each is a toggle in your project's MCP settings and you can run them together. CIMD is the registration method the current MCP authorization spec recommends, and CIMD clients need no allowlist entry. We recommend turning CIMD on and leaving DCR enabled only for the clients that haven't caught up. ### Which AI clients work with MCP authentication? Any OAuth 2.1 client. We provide ready-made configurations for popular clients like Claude Desktop, ChatGPT, Cursor and Gemini, and you can add your own. Clients that run on the user's machine, like Claude Code and Cursor, redirect back to localhost, and the consent screen handles that with a warning that names the client and the port. Older clients that never send a resource parameter can be covered with the Default Resource setting. ### Does MCP authentication work with Enterprise SSO and role-based access control? Yes. MCP authentication uses the same login methods as the rest of your product. If a customer's organization has SAML or OIDC set up, their employees sign in through Okta, Microsoft Entra ID or whichever identity provider they use, and that provider's policies such as MFA apply to the AI connection too. Organization scopes then limit which roles can grant an AI client access to shared data, so your customer's existing roles become the policy for AI access. There is nothing extra to configure. ### I have less frequently asked questions... Reach out to us at support@propelauth.com. ## Get started Sign up: https://auth.propelauth.com/en/signup Request a demo: https://calendly.com/andrew-propelauth/propelauth-integration-chat