Skip to content

mcp: clarify custom oauth server requirements #482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paulRbr merged 1 commit into from
Aug 27, 2026
Merged

mcp: clarify custom oauth server requirements #482

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/_help/mcp-servers/access-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ You can choose whether your MCP server is public or private:

Server visibility is set during the MCP server creation, and can be changed at any time in your MCP server settings.

![Access management module of the MCP server](/docs/images/help/mcp-servers/mcp-servers-access-management.png)
![Access management module of the MCP server](/docs/images/help/mcp-servers/mcp-servers-access-management.png)

#### Private MCP servers using a Bump.sh account (default)

Expand All @@ -25,7 +25,8 @@ If your users already have accounts in your own identity provider (Okta, Auth0,

**On your side:** set up an authorization server in your identity provider and configure the appropriate scopes and clients. Refer to your provider's documentation for this step.

> Only OAuth servers are supported for now. For validation purposes, the server needs to be set up using [JWT tokens](https://oauth.net/2/jwt/) or a [UserInfo endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo).
> Only OAuth servers supporting either the legacy DCR (Dynamic Client Registration) or the state-of-the art CIMD (ClientID Metadata Document) client registration methods are supported for now.
> Also, the server needs to be set up using [JWT tokens](https://oauth.net/2/jwt/) or a [UserInfo endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo) for validation of the user token during an MCP client request.
{: .info}

**On Bump.sh side:** provide the URL of your OAuth authorization server in your MCP server settings. Bump.sh will redirect users through your authentication flow before granting access.
Expand All @@ -45,4 +46,4 @@ Once your MCP server is set up, here is what your users will experience, regardl

Controlling access to the MCP server itself is only one layer. The APIs your workflows call may also require authentication, for example, to act on behalf of a specific user or pass credentials at runtime.

[Secrets and config](/help/mcp-servers/secrets-and-config/) covers both server-wide credentials and per-user values forwarded at runtime.
[Secrets and config](/help/mcp-servers/secrets-and-config/) covers both server-wide credentials and per-user values forwarded at runtime.
Loading