Connecting an MCP Client
Once your authorization server and MCP server are configured (see Installation and Step-by-step deployment guide), you can connect any MCP client that supports remote, OAuth2-authenticated MCP servers. Exact setup steps differ per client, but they all follow the same general pattern.
What you'll need
The MCP server URL. SaaS customers should use the URL communicated by their Elimity account manager; on-prem customers use their own
baseUrl.The OAuth2 client ID and client secret created for the MCP client application in step 1.1, unless your client supports Dynamic Client Registration and your authorization server is configured to allow it.
General setup pattern
Add the MCP server to your client, using the server URL above.
Provide your OAuth2 credentials. Depending on the client, this means either entering the client ID and secret manually, or letting the client register itself automatically with your authorization server via Dynamic Client Registration (DCR, RFC 7591).
Register the client's callback URL. Depending on the client, this is either a fixed value documented by the client (as with Claude's hosted surfaces), a value you choose yourself (as with Claude Code's local loopback callback), or a value the client generates and reveals only once you start adding the server (as with Copilot Studio). In the latter case, add the server first, copy the callback URL it shows you, then register it as an allowed redirect URI on the application you created in step 1.1, at your authorization server, before completing sign-in.
Claude
For Claude.ai, desktop, mobile, and Cowork, go to 'Settings' → 'Connectors' → 'Add custom connector', enter the MCP server URL, then expand 'Advanced settings' to enter the client ID and secret from step 1.1. Leave 'register one automatically' unchecked unless you're relying on DCR instead. The callback URL is fixed: https://claude.ai/api/mcp/auth_callback.
For Claude Code, run:
claude mcp add <name> --transport http --client-id <id> --client-secret --callback-port <callback-port> <server-url>Claude Code is a local client, so it uses a loopback redirect (http://localhost:<port>/callback) instead of a hosted callback URL. Add --callback-port <port> to pin it to a fixed port, and register that URL as an allowed redirect URI on the application from step 1.1, at your authorization server, instead of the one above.
Microsoft Copilot
Go to your agent's 'Tools' page and select 'Add a tool' → 'New tool' → 'Model Context Protocol'. Enter the server name and URL, choose 'OAuth 2.0' as the authentication type and 'Manual' configuration, then fill in the OAuth2 client ID and secret from step 1.1 along with your authorization server's authorization and token endpoints (for Auth0, these are https://<tenant>/authorize and https://<tenant>/oauth/token). After selecting 'Create', Copilot Studio generates a callback URL. Register it as an allowed redirect URI on the application from step 1.1, at your authorization server, before continuing.
Other clients
For any other MCP client, consult its own documentation for connecting to a remote MCP server with OAuth2 (sometimes listed under 'custom connector' or 'integrations'). The same general pattern applies: supply the server URL and your OAuth2 client ID and secret from step 1.1, then register whatever callback URL the client presents as an allowed redirect URI on that application, at your authorization server.
Last updated