MCP authentication

The platform uses OAuth 2.0 for MCP authentication. Interactive clients can automatically complete the authorization stream. Clients who require a static credential can use a scalable OAuth token created in the platform’s user interface.

Both methods send an access token to the HTTP header Authorization:

Authorization: Bearer <credential>

OAuth discovery

A client MCPar should start with the end pointMCPfor implementation:

• US: https://us.probo.com/api/mcp/v1
• EU: https://eu.probo.com/api/mcp/v1
• Self-hosted: https://<your-host>/api/mcp/v1

An unauthenticated request returns ___ZBT_I18N_RUNTIME_BLOCK_173__ with a

RFC 9728 Protected Resource Metadata URL

:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://us.probo.com/.well-known/oauth-protected-resource"

Get that URL to discover the resource, authorization server, carrier token method, and supported resource domains:

{
  "resource": "https://us.probo.com",
  "authorization_servers": ["https://us.probo.com"],
  "bearer_methods_supported": ["header"],
  "scopes_supported": ["openid", "v1:iam", "v1:risk"]
}

The abbreviated answer above illustrates the fields, not the full list of fields. Always use the implementation returned values.

The authorization server publishes both discovery documents:

US

https://us.probo.com/.well-known/oauth-authorization-server
https://us.probo.com/.well-known/openid-configuration

EU

https://eu.probo.com/.well-known/oauth-authorization-server
https://eu.probo.com/.well-known/openid-configuration

Self-hosted

https://<your-host>/.well-known/oauth-authorization-server
https://<your-host>/.well-known/openid-configuration

Discovery provides implementation authorization, token, registration, revocation, introspection, device authorization and JWKS endpoints. It also announces the types of grants accepted, token endpoints authentication methods, PKCE methods and domains.

the platform supports:

• Authorization code with PKCE using S256
• Refresh your tokens with offline_access
• OAuth 2.0 Device Authorization
• Dynamic Client Registration
• Client ID Metadata Documents

MCPar customers should use discovery instead of building OAuth endpoint URLs.

Access token lifetime and refresh

Interactive clients who need to stay connected should request offline_access. the platform issues a refresh token only when both conditions are met:

• The authorization application includes the domain ___ZBT_I18N_RUNTIME_BLOCK_184__.
• The customer registration includes the grant type ___ZBT_I18N_RUNTIME_BLOCK_185__.

When the access token expires, send the refresh token to the token_endpoint announced discovery:

POST /api/connect/v1/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&refresh_token=<refresh-token>&client_id=<client-id>

a successful refresh returns a new access token and a new refresh token; replace both atomically stored values and do not reuse the previous refresh token.

Without offline_access, the user must re-authorize the client after his access token expires.

___ZBT_I18N_RUNTIME_BLOCK_187__

OAuth tokens created manually in the platform’s user interface are standalone access tokens. They do not include a refresh token. Choose an appropriate expiration and create a replacement when needed.

Client registration

Dynamic Client Registration

Customers can register via registration_endpoint announced by the discovery of the authorization server. Public customers use token_endpoint_auth_method: "none" and PKCE. Confidential customers can use client_secret_basic or client_secret_post.

Client ID Metadata Documents (CIMD)

with CIMD, OAuth client_id is a HTTPS URL that returns the client’s metadata document.

Authorization Server announces support with:

{
  "client_id_metadata_document_supported": true
}

A CIMD document used with the platform must:

• To be served as JSON from the exact HTTPS URL used as client_id
• Setting client_id to the same URL
• Includes client_name and at least one redirect_uri
• Use token_endpoint_auth_method: "none"
• Use of HTTPS redirect URIs, except HTTP loopback redirect for local clients
• Apply only for domains registered by the platform deployment

Example:

{
  "client_id": "https://client.example.com/oauth/client.json",
  "client_name": "Example MCP Client",
  "client_uri": "https://client.example.com",
  "redirect_uris": ["https://client.example.com/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "openid offline_access v1:iam:read v1:risk:read"
}

___ZBT_I18N_RUNTIME_BLOCK_203__

Self-hosted implementations only support explicitly permitted CIMD client IDs. Configure accurate metadata URLs with PROBOD_OAUTH2_SERVER_CIMD_ALLOWED_CLIENT_IDSAn empty permission list disables third-party CIMD clients.

Scopes

OAuth Access is the intersection between allocated domains and user platform permissions. A domain never gives a user access to an organization or operation that their account cannot otherwise access.

Resource scopes use these forms:

• v1:<resource>:read provides reading operations for a resource family.
• v1:<resource> provides both reading and writing operations for that family.

For example:

• listOrganizations requires an IAM domain such as v1:iam:read.
• ___ZBT_I18N_RUNTIME_BLOCK_210__ requires v1:risk:read or v1:risk.
• Creating or updating risks requires v1:risk.
• Third party reading requires v1:third-party:read or v1:third-party.

Other resource families include asset, audit, control, document, privacy, itam, compliance-page, , itam

Standard domains have their common meanings of OAuth and OpenID Connect:

• ___ZBT_I18N_RUNTIME_BLOCK_224__ requires an OpenID Connect identity token.
• profile and email identity requests.
• offline_access requests a refresh token.

The authorization server discovery document includes the full list, including the variants :read.

OAuth tokens for static configuration

If a MCP client cannot complete an interactive OAuth stream, create a comprehensive OAuth token on the platform:

1. Open the account menu and select OAuth tokens.
2. Select Create token.
3. Enter a name, select an expiration and select only the domains that the client needs.
4. Create and copy the token. the platform displays its value only once.

Stores the token in the secret or variable mechanism of the client’s environment.For clients who support the expansion of the environment:

For customers who support environmental expansion:

{
  "mcpServers": {
    "probo": {
      "url": "https://us.probo.com/api/mcp/v1",
      "headers": {
        "Authorization": "Bearer ${env:PROBO_OAUTH_TOKEN}"
      }
    }
  }
}

The token is subject to both the selected domains and the permissions of the account that created it. Create a separate token for each client or environment so that it can be audited and revoked independently.

Authentication errors

A missing credential returns a discovery challenge:

WWW-Authenticate: Bearer resource_metadata="https://us.probo.com/.well-known/oauth-protected-resource"

An invalid, expired or unrecognized holder credential returns:

WWW-Authenticate: Bearer error="invalid_token", resource_metadata="https://us.probo.com/.well-known/oauth-protected-resource"

Once the shipment is authenticated, authorization failures are returned by calling the tools:

• insufficient scope means that the OAuth token does not assign a mapped domain to the requested operation.
• permission denied means that the logged-in user cannot perform the operation on this resource.
• assumption required means that the operation requires an active organizational context.

Changing the credential formatting will not fix a domain or permission error.

Credential handling

Use HTTPS and keep your tokens out of source control, logs, chat prompts and configuration files that will be shared. If an OAuth token can be exposed, revoke it, issue a replacement, update the client and review relevant activity.