Guide
Authentication for Oi MCP.
The hosted Oi MCP server supports two practical auth paths: OAuth through the Oi app, or bearer-token auth using an exported organization API key.
Choose the right path
OAuth
Best when the client has a native sign-in flow and you want per-user authorization through the Oi app.
Organization API key
Best when the client expects a bearer token field and your team wants a direct setup path using an exported org credential.
Good practices
- Store the bearer token in the client's secret or environment-variable field when possible.
- Prefer OAuth when the client supports it cleanly and you want end-user sign-in semantics.
- Prefer an organization API key when the client only supports direct bearer-token configuration.
- Rotate organization API keys if access should change or if a token is exposed.
Bearer auth shape
Authorization: Bearer <token>
Accepted token types:
- OAuth access token issued by Oi
- exported Oi organization API keyFor direct client setup, the most common path is to put the Oi token in a secret field or environment variable, then point the client at the hosted MCP URL.