MCP OAuth
MCP OAuth is how a remote MCP server signs in the person using an AI app: the app opens the server's sign-in page, you approve access, and the app gets a token it sends with every call.
Updated
On this page
What it is
The MCP specification builds authorization on OAuth 2.1. An MCP client discovers the server's sign-in endpoints from a metadata address, can register itself as a client, and runs the authorization code flow with PKCE, so no password ever passes through the AI app.
Access tokens are short-lived and are renewed with a refresh token, and you can take access away from the server's side at any time.
In Xodia
When you add Xodia to an AI app, the app opens Xodia's sign-in page and asks you to allow access to your workspace. After that, your AI acts as you: it sees the projects you can see and is held to your role and plan.
In Claude Code you sign in from the /mcp menu after installing the plugin; in the Claude app it happens when you add the custom connector.
Read more
Related terms
- MCP (Model Context Protocol)MCP, the Model Context Protocol, is an open standard that lets an AI app connect to outside tools and data through one common interface.
- Streamable HTTPStreamable HTTP is the MCP transport for remote servers: the client sends each message as an HTTP POST to one endpoint, and the server can answer with a single response or a stream of events.
- StagingStaging is a copy of a website where changes are checked before they go live, usually built from a separate branch and kept away from visitors and search engines.