MCP service authentication
Configure the credentials a connected MCP service requires for tool discovery and execution.
What it is
Authentication supplies the credentials INSIDE uses when contacting a connected MCP service. A connection can use no authentication, a bearer token, named credential headers or OAuth. The same configured identity is used for discovery and tool execution.
Who uses it and why
Administrators arrange the service access their AI features need. Developers provide the remote service's authentication requirements and check the permissions attached to its credentials. Powerfront manages these settings on your behalf.
Where to find it
Powerfront manages Authentication in the MCP Server editor under Settings › AI › Connections. Ask Powerfront to create or change the connection credentials for you.
How it works
| Auth Type | Request behaviour |
|---|---|
| None | Adds no authentication from this selector; configured Default Headers still apply |
| Bearer Token | Sends the configured bearer credential |
| Header Tokens | Adds the configured Auth Headers |
| OAuth | Obtains an access token and sends it as a bearer credential |
INSIDE first applies Default Headers, then the selected authentication. Authentication can replace a default header with the same name.
OAuth supports Client Credentials and Authorization Code. It reuses unexpired tokens separately for each website and connection. It attempts another token request when a token expires, allowing a 30-second margin before the supplied expiry. If no expiry is returned, it assumes one hour before that margin.
Saving or deleting a connection clears its website's cached provider and token state. An OAuth failure prevents the authenticated request rather than continuing without its required token.
Configure it
Give Powerfront the approved service address, Auth Type and credential requirements. For Header Tokens, provide each required header name and value. For Bearer Token, provide the service's bearer credential through the agreed secure process.
For OAuth, provide Token URL and Client ID, plus the secret required by the provider. Client Credentials can include Scopes and Audience. Authorization Code needs a supplied Authorization Code and, where required, Redirect URI.
Ask Powerfront to save and test the connection, then verify that the intended tools are available. Use the remote credential's permissions to limit the operations it can perform.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Auth Type | Settings › AI › Connections | website | None | Powerfront | Chooses None, Bearer Token, Header Tokens or OAuth for this connection. Default Headers still apply when None is selected. |
| OAuth Flow | Settings › AI › Connections | website | Client Credentials | Powerfront | Chooses Client Credentials or Authorization Code for OAuth token acquisition. |
| Default Headers | Settings › AI › Connections | website | Not set | Powerfront | Adds connection headers before the selected authentication headers are applied. When unset, no extra connection headers are added. |
Fields
| Field | Where | Required | What it is for |
|---|---|---|---|
| Bearer Token | Settings › AI › Connections | Yes | Supplies the token used by Bearer Token authentication; required for a new connection using that type. |
| Auth Headers | Settings › AI › Connections | Yes | Supplies named credential headers; at least one is required for a new Header Tokens connection. |
| Token URL | Settings › AI › Connections | Yes | Supplies the address used to obtain an OAuth access token; required for OAuth. |
| Auth URL | Settings › AI › Connections | No | Records the authorisation address; token acquisition uses Token URL and the supplied credentials or code. |
| Client ID | Settings › AI › Connections | Yes | Identifies the OAuth application; required for OAuth. |
| Client Secret | Settings › AI › Connections | No | Supplies the application's secret when required by the token service. |
| Scopes | Settings › AI › Connections | No | Supplies comma-separated scopes for a Client Credentials token request. |
| Authorization Code | Settings › AI › Connections | Yes | Supplies the code to exchange in the Authorization Code flow; required for a new connection using that flow. |
| Redirect URI | Settings › AI › Connections | No | Supplies the redirect address included in an Authorization Code token request when needed. |
| Audience | Settings › AI › Connections | No | Supplies an optional audience for a Client Credentials token request. |
Limits and good to know
- Connection authentication does not grant an AI feature permission to call every tool. Function enablement and feature assignment still apply.
- None does not remove credentials entered in Default Headers.
- OAuth token requests have a 30-second deadline. Token responses larger than 65,536 characters are rejected, with bounded reads before parsing.
- The Authorization Code choice exchanges a configured code. It is not an operator sign-in or interactive consent screen.
- If a code cannot be reused after token expiry, Powerfront may need a new authorisation code. Do not assume automatic refresh-token support.
- Credential rotation must also be reflected in the INSIDE connection. Ask Powerfront to update and retest it.
Depends on and works with
View all connections as a list
This feature uses
- Shared AI service connectionsRequires
Authentication is stored on a website's MCP connection.
- MCP tool connections for AIRelated
Check MCP tool setup when authentication succeeds but the required operation remains unavailable.
Used by
- AI integrations and automation toolsConfigured by
MCP connection authentication and outbound controls apply to MCP requests.
- Shared AI service connectionsConfigured by
MCP connection authentication settings determine the credentials sent for discovery and tool calls.
- MCP tool connections for AIConfigured by
The connection's authentication choices supply request credentials where needed.
FAQ and troubleshooting
Why does discovery fail with an authentication error?
Ask Powerfront to check Auth Type, the credentials and the remote service's permissions. For OAuth, ask Powerfront to check Token URL, Client ID and any required secret, scope or audience.
Why did Authorization Code work once and then fail later?
The provider may reject reuse of the configured code after the cached token expires. Ask Powerfront to check whether a fresh code or another supported authentication arrangement is needed.
Why are credentials still sent when Auth Type is None?
Default Headers are applied independently. Ask Powerfront to review those headers as well as the authentication selection.
Can two websites share a cached OAuth token automatically?
No. This token cache separates website and connection identities. Each connection must have suitable authentication configured.
Why is a token response rejected even though the token service is reachable?
The service may have failed to return a usable access token, exceeded the response-size limit or taken longer than the deadline. Ask Powerfront to inspect the connection test and provider response.