Availability
The application can expose OAuth metadata only when an actual issuer is configured for the deployment. Without that configuration, use a supported Bearer API-key connection or ask the team to set up the sign-in flow. A marketing page is not evidence that OAuth is active.
Before connecting a client
Confirm the issuer, authorization and token endpoints, redirect URLs, client registration policy, requested scopes, and the organization membership represented by the resulting token. Each assistant client may have its own requirements for remote connectors.
Approval is separate from sign-in
Signing in authenticates a user. It does not approve every future communication the assistant proposes. A call or text must still show the intended recipient and task and receive human approval before dispatch.
Token handling
Keep access and refresh tokens in the client's supported secure storage. Do not put them into a public prompt, URL query string, committed config file, or analytics event. Revoke a connection when it is no longer needed.
If your connector cannot authenticate
Do not remove authentication from the MCP server. Review the client requirements and the configured issuer instead. The API-key guide describes the alternative when your client supports a secure custom-header connection.