Skip to main content
Feedback

Static OAuth support

Static OAuth support in MCP Gateway extends the existing client credentials flow by adding support for device flow authorization (OAuth 2.0 Device Authorization Grant). You can configure OAuth or static OAuth authentication method depending on your needs.

note

By default, MCP Gateway includes a single default config for GitHub. However, user-defined configuration overrides pre-defined defaults.

How to use

Add the static OAuth snippet to your app.yaml to enable OAuth with device flow. Then, restart your MCP Gateway server and log in through the browser with the device code shown in the user interface.

Choosing the right flow

  • Client credentials flow is suitable when users provide their own organizational or personal OAuth app credentials.

  • Device flow is useful when you want to avoid distributing a client secret (for example, with a new GitHub OAuth app) or override defaults.

Client credentials flow

Example: Private GitHub apps using a client ID and secret.

staticOauth:
  mapping:
    github.com: github-static
    api.github.com: github-static
  providers:
    github-static:
      authMethod: client_credentials
      credentials:
        clientIdEnv: "GITHUB_OAUTH_CLIENT_ID"
        clientSecretEnv: "GITHUB_OAUTH_CLIENT_SECRET"
      scopes: [repo, user, read:org]
      tokenAuthMethod: client_secret_post

Device flow

Example: Public GitHub apps where no secret is needed.

staticOauth:
  mapping:
    github.com: github-device
    api.github.com: github-device
  providers:
    github-device:
      authMethod: device_flow
      credentials:
        clientIdEnv: "GITHUB_DEVICE_CLIENT_ID"
      scopes: [repo, user, read:org]
      endpoints:
        deviceAuthorizationUrl: https://github.com/login/device/code
        tokenUrl: https://github.com/login/oauth/access_token
        userVerificationUrl: https://github.com/login/device

Parameters

This section describes the two top-level keys in the staticOauth configuration: mapping and providers.

mapping

Type: List of Map
Maps a domain or host to a provider key defined under providers and associates the domain with a provider key.

providers

Type: Map of objects
A dictionary of provider configurations. Each entry corresponds to a single OAuth provider to define the authentication details for each provider key. Each provider must specify an authMethod, which is either client_credentials or device_flow.

client_credentials parameters

Used for private or organizational OAuth apps that include both a client ID and client secret.

authMethod

Type: client_credentials" Required: Yes
Selects the client credentials flow.

clientIdEnv

Type: string Required: Yes
Environment variable name that holds the OAuth client ID.

clientSecretEnv

Type: string Required: Yes
Environment variable name that holds the OAuth client secret.

scopes

Type: string
Required: Yes
OAuth scopes requested for this provider.

tokenAuthMethod

Type: enum Required: Yes
Defines how client credentials are sent to the token endpoint. Optional inputs are:

  • client_secret_basic
  • client_secret_post
  • client_secret_jwt
  • private_key_jwt
  • tls_client_auth
  • self_signed_tls_client_auth

device_flow parameters

Used for public OAuth apps where no client secret is required. You authenticate by entering a code on a verification page.

authMethod

Type: device_flow Required: Yes
Selects the device flow authorization method.

clientIdEnv

Type: string Required: Yes
Environment variable name that holds the OAuth client ID.

scopes

Type: string[] Required: Yes
OAuth scopes requested for this provider.

deviceAuthorizationUrl

Type: string Required: Yes
URL of the provider’s device authorization endpoint.

tokenUrl

Type: string Required: Yes
URL of the provider’s token endpoint.

userVerificationUrl

Type: string Required: Yes
URL users visit to enter the device code and complete authorization.

On this Page