Skip to content

Authorization for agents

Secure auth for MCP servers

Give agents access to your app with OAuth 2.1 flows, tool permissions, PKCE, scopes, and more.

Get startedExplore MCP docs
Authorization for agents
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Get started with MCP

Everything you need to master the basics and ship your first server

1

Add OAuth to your MCP server

Paycux AuthKit acts as a compatible OAuth 2.1 authorisation server for MCP apps, following the current protocol specification. We take the complexity of an evolving protocol and make securing it as easy as pasting a URL.

2

Fork an example

Get started quickly with open source templates. AuthKit for MCP supports every language and framework — pick the one closest to your stack and change the domain.

3

Bring your own users

Already have users and login? Paycux Connect can run as standalone middleware to provide only the MCP OAuth flows — no migration necessary.

The protocol, handled

Add OAuth to your MCP server

Paycux AuthKit handles all the complexity of the OAuth authorisation server. You just build the MCP tools and resource endpoints.

  • OAuth 2.1 authorisation server, tracking the current MCP specification
  • Dynamic client registration, so a client you have never seen can still connect safely
  • Protected resource metadata and authorisation server discovery served for you
  • PKCE on every flow, and short-lived access tokens with rotation
  • Point your server at an AuthKit domain and validate the JWT — that is the integration
The protocol, handled
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Agent authorization

Authorise the agent, not just the user

An agent acting on someone's behalf should not inherit everything that person can do. Scope the grant to the tools it needs, and take it back the moment that changes.

  • Fine-grained authorisation for agentic applications and workflows
  • Tool-level scopes: the agent sees only what the consent screen actually granted
  • The same users, organisations and roles as the rest of your product
  • Revoke a grant in one call and the next tool invocation fails immediately
  • Every tool call lands in the audit trail with the human and the agent both named
Agent authorization
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Everything included

Auth for MCP has never been easier

You build the tools and the resource endpoints. The authorisation server, the discovery documents and the token lifecycle are ours.

OAuth 2.1 authorization serverA compatible authorisation server for MCP apps, based on the latest protocol specification, kept current as the specification moves.
Dynamic client registrationClients register themselves at connect time, so you do not maintain a list of every agent host your customers might use.
PKCE and scoped tokens by defaultThe strongest available flow is chosen for you, with short-lived access tokens and refresh handled on the client side of the protocol.
Tool permissionsMap MCP tools onto scopes and roles. An agent authorised to read cannot quietly discover a write path.
Bring your own usersRun MCP OAuth as standalone middleware in front of the identity system you already have. No user migration, no dual source of truth.
Audit trail for every tool callAppend-only events naming the user, the client and the tool — the record your customer's security team will ask for the week after you ship.

Paste a URL, ship a secured server

The authorization server is configuration, not a project.

Point your MCP server at your AuthKit domain. Discovery, token validation and scope enforcement come with it.

1# server.py
2from fastmcp import FastMCP
3from fastmcp.server.auth.providers.paycux import AuthKitProvider
4 
5# The AuthKitProvider automatically discovers Paycux endpoints
6# and configures JWT token validation
7auth_provider = AuthKitProvider(
8    authkit_domain="https://your-project.authkit.paycux.com",
9    base_url="http://localhost:8000",  # Use your actual server URL
10)
11 
12mcp = FastMCP(name="AuthKit Secured App", auth=auth_provider)

Transparent pricing

Priced by monthly active user

MCP Auth is part of AuthKit — the same authorisation server that signs your users in also authorises their agents. There is no separate line item for adding an MCP surface.

See full pricingTalk to an expert
OAuth 2.1 authorization serverIncluded
Dynamic client registrationIncluded
Tool-level scopes and rolesIncluded
Agent and tool audit trailIncluded
Custom enterprise plansContact sales

Questions

Frequently asked

Do I have to move my users to Paycux?

No. Paycux Connect can run as standalone middleware that provides only the MCP OAuth flows in front of the identity system you already operate. No migration necessary.

Which parts of the MCP authorisation spec do you implement?

The OAuth 2.1 authorisation server role: discovery documents, dynamic client registration, PKCE, scoped access tokens and protected resource metadata. Your server validates the token and serves the tools.

How do tool permissions work?

Tools are mapped to scopes, and scopes are granted at consent time against the user's roles. An agent that was granted read access cannot invoke a write tool, even if it discovers the name.

What happens when a user revokes an agent?

The grant is destroyed and the next tool invocation fails. Because access tokens are short-lived, there is no long tail of a revoked agent still holding a usable credential.

Can I see what an agent actually did?

Yes. Every tool call is recorded with the human on whose behalf it ran, the client that made it, and the scope it used — searchable in the dashboard and streamable to your own systems.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
Enterprise SSOUnified SSO for any identity provider
RadarRealtime protection against bots, fraud and abuse
AuthKitCustomisable UI for every authentication type
Directory SyncUser lifecycle from corporate directories
Role-Based Access ControlPowerful and flexible permissions for your users

Ready to get started with MCP?

Explore the docs, fork an example project, and ship a secured MCP server without writing an authorisation server of your own.

Get startedTalk to an expert