OAuth Client Credentials

The gateway gets its own access token from an MCP server’s OAuth provider and sends it on every request.

With OAuth client credentials, the gateway authenticates to an MCP server or API as itself. It gets an access token from the server’s OAuth provider with the client_credentials grant, and sends it as Authorization: Bearer <token> on every request. Every agent reaches the server under that one identity.

​

Settings

The server’s auth names the provider’s token endpoint and the gateway’s client:

{
  "type": "oauth_client_credentials",
  "token_url": "https://auth.example.com/oauth/token",
  "client_id": "example-client",
  "client_secret": "example-client-secret",
  "scopes": ["orders.read"],
  "audience": "orders-api"
}

• token_url is the provider’s token endpoint.
• client_id and client_secret identify the gateway. credentials_in sends them in the token request’s body (body, the default) or as HTTP Basic authentication (basic).
• scopes, audience, and resource are optional, and go in the token request.

​

Token Lifetime

The gateway keeps the token and gets a new one a minute before it expires. A token without an expiry is kept for 5 minutes. When the server answers 401, the gateway gets a new token and retries the request once.