MCP Server Auth

Authorization options

1. Manual setup: no authorization, token, or headers.

• No authorization is suitable for an open or internal server that does not require a secret.

2. Access token.

• It is sent as Authorization: Bearer <token>.
• Enter only the token itself in the field.
• If the secret is already saved and the user does not want to change it, the field can be left blank if the form supports saving the current secret.

3. Custom headers.

• Add pairs of header names and values.
• You need to fill in both the name and the value.
• Suitable for X-API-Key, Authorization: Basic ..., and other custom authorization schemes.

4. MCP OAuth.

• Standard OAuth authorization for a remote MCP server.
• OAuth connection opens the authorization window and saves the token after completion.

User authorization in an external MCP

Some MCP servers require not only project authorization, but also separate authorization of an external user or lead. In this case, an agent tool can work only after the required user connects their account in the external service.

In the MCP server list, "Per lead" means access is granted to specific users rather than through one shared project token. For a project connection, the cabinet shows the related project, group, channel, account, workspace, or external ID when the MCP server provides it.

If authorization expired or the external service rejected the token, reconnect the account through OAuth or update the manual access data. Do not paste secrets into dialog messages: tokens and custom headers must be entered only in the MCP server authorization form.

Access validation

After saving a token or OAuth connection, check its status. A successful check means the MCP server accepted the credentials. For an error or unknown state, open the message, verify the token, header values, and external-service permissions, then validate again.

Apply a manual token and headers with "Save". Then run connection validation.

If the agent cannot call an MCP tool, first check whether this server is selected for the agent, then check project authorization or user authorization status, and only after that check the event logs.

If OAuth fails

• check that the authorization window is not blocked by the browser;
• check the server URL;
• check that the server supports MCP OAuth;
• repeat authorization;
• check the error text.

Removing an MCP server

• deleting the server is dangerous and requires confirmation;
• if the server is used by agents, their tools will stop working;
• first check the agents where it is selected.

Where this is in the interface

Main elements in this section:

• project settings page
• Settings item in the side menu