OAuth provides a secure, standards-based way for an
Prerequisites
- You are an administrator in your Staffbase platform.
- You have OAuth clients activated for your platform. Contact Staffbase Support or your Customer Success Manager for more information.
- You have an AI client that supports MCP registration.
- You know how to add and configure an MCP server connection in your AI client.
Step 1: Identify the MCP endpoint
You need to identify your MCP Server endpoint. The MCP Server is served from the same domain as your Staffbase platform.
If your platform domain URL is https://mycompany.com, your MCP server endpoint is https://mycompany.com/mcp
Step 2: Collect the redirect URIs and origins of your AI client
Each AI client completes the authorization code flow on a fixed callback URL. Take that URL from the documentation of the client you want to connect, together with the browser origin the client calls the endpoint from. Clients that run in a browser use a hosted callback URL and an origin such as https://claude.ai. Clients that run on the local machine use a loopback address and need no origin.
Examples for callback URLs are:
| AI client | Where it runs | Callback URL |
|---|---|---|
| Claude web | Browser | https://claude.ai/api/mcp/auth_callback |
| Claude Code, Claude Desktop | Local machine | http://127.0.0.1/callback |
| OpenCode | Local machine | http://127.0.0.1/mcp/oauth/callback |
Step 3: Create an OAuth client
Create an OAuth Client with the following configuration:
| Setting | Value |
|---|---|
| OAuth Client Type | SPA |
| Client name | MCP Note: The Client Name must be exactly MCP. The MCP Server resolves its OAuth configuration by this name, and authorization fails if the name differs. |
| Redirect URIs | The callback URL(s) provided by your AI client. These URLs depend on the AI client and the environment in which it runs. For example, the URL of web, desktop, or CLI. |
| Scopes | Enter a single whitespace character. The MCP Server does not require specific OAuth scopes. |
| Allowed CORS origins | Enter the browser origin(s) used by your AI client. Only origins that make browser-based requests to the MCP Server need to be added. |
Step 4: Register the MCP Server endpoint in your AI client
Add the MCP server endpoint to your AI client and register your connection. Access the available tools.
Step 5: Authorize the connection
Start the connection from your AI client. The client and the server complete the standard MCP authorization flow:
- The client calls the endpoint without a token and receives
a 401 Unauthorizedresponse with aWWW-Authenticateheader pointing to the protected resource metadata. - The client reads the metadata, discovers the authorization server, and registers itself through Dynamic Client Registration.
- The client opens a browser window for the Staffbase login.
Sign in as the identity the agent acts for. After consent, the client reports a successful connection.