MCP server

Authalla exposes a Model Context Protocol (MCP) server that lets AI assistants manage your tenants, users, OAuth2 clients, branding, domains, and more — directly from your editor or chat.

Quick start

Add the Authalla MCP server URL to your client:

https://login.authalla.com/mcp

That's it. Your MCP client will handle authentication automatically using OAuth2 with PKCE — you'll be prompted to sign in through your browser the first time.

Setup for Claude Code

Add the MCP server with a single command:

claude mcp add authalla https://login.authalla.com/mcp

Claude Code will detect the OAuth2 authorization server from the /.well-known/oauth-protected-resource metadata and open your browser to authenticate.

Once connected, you can ask Claude to manage your Authalla tenant directly:

> Create a new OAuth2 client called "my-app" with redirect URI http://localhost:3000/callback
> Update the login page theme to use dark blue as the primary color
> Add a custom domain app.example.com to my tenant

Setup for Claude Desktop

1. Open Claude Desktop and go to Settings > MCP Servers
2. Add a new server with the URL:

https://login.authalla.com/mcp

3. Claude Desktop will open your browser to authenticate with Authalla
4. Once connected, the Authalla tools appear in the tools menu

Setup for VS Code

Add this to your VS Code settings.json (or workspace .vscode/mcp.json):

{
  "mcp": {
    "servers": {
      "authalla": {
        "url": "https://login.authalla.com/mcp"
      }
    }
  }
}

VS Code will prompt you to authenticate when the MCP server is first used.

Setup for Cursor

Add a .cursor/mcp.json file to your project root:

{
  "mcpServers": {
    "authalla": {
      "url": "https://login.authalla.com/mcp"
    }
  }
}

Authentication

The MCP server uses standard OAuth2 with PKCE for authentication. When your MCP client connects for the first time, it:

1. Fetches /.well-known/oauth-protected-resource to discover the authorization server
2. Opens your browser to sign in with your Authalla account (passkey, magic link, or social login)
3. Receives an access token that is used for all subsequent requests

Tokens are refreshed automatically. You don't need to manage API keys or secrets.

Available tools

The MCP server exposes the following tools for managing your Authalla tenant:

Account

Tenants

Users

OAuth2 clients

Branding

Custom domains

Custom email domains

Social login

Multiple tenants

If your account has multiple tenants, tools that operate on a specific tenant accept an optional tenant_id parameter. If your account has only one tenant, it is selected automatically.

Use the get_me tool to list your tenants and their IDs.

M2M access

For automated pipelines or custom integrations, you can authenticate using OAuth2 client credentials instead of a browser login. Create a Backend Service client in the Admin Dashboard and use the client credentials grant:

curl -X POST https://your-tenant.authalla.com/oauth2/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=tenants:read users:read clients:read"

The access token can then be passed in the Authorization header when calling the MCP endpoint directly.

Available scopes