Set up sign-in for managed MCP servers - Claude.ai Documentation

For a remote managed MCP server that uses OAuth, Claude Desktop signs each user in through the browser: the user clicks Connect, signs in to the server’s identity provider (the OAuth service its vendor runs, for example Google or Box), and Claude Desktop stores the resulting token encrypted on the device. What you configure depends on that identity provider. Some register Claude Desktop as a client automatically, some require an OAuth client that you register, and some also require that client’s secret. This page is for administrators who add servers on the Connectors page of the Enterprise Admin Console. The in-app configuration window has the same fields, and in an MDM or bootstrap configuration they are the oauth keys of a managedMcpServers entry. For the redirect URI, discovery, and token handling in detail, see OAuth sign-in.

Choose the OAuth setting

In the Enterprise Admin Console (claude.ai → Organization settings), open the Connectors page under Desktop 3P. Each remote entry under Managed MCP servers has an OAuth menu. Choose the setting that matches what the server’s identity provider requires.

If the identity provider	OAuth setting	What you register at the identity provider	Fields to fill in
Supports dynamic client registration	Auto-register (dynamic client registration)	Nothing. Claude Desktop registers itself as a client on each device when the user first clicks Connect	None
Requires an OAuth client that you register (no dynamic client registration)	Bring your own client	A public OAuth client (native or desktop application type) with redirect URI `http://127.0.0.1:53280/callback` and no secret	Client ID
Requires a registered client and rejects token requests that don’t carry the client secret	Bring your own client	An OAuth client with redirect URI `http://127.0.0.1:53280/callback`, plus its client secret	Client ID, Authorization server, and the secret in Client secret or Client secret helper script

Leave the OAuth menu set to None for a server that needs no sign-in or that authenticates with request headers. The menu also lists Anthropic-hosted client identity (requires Claude.ai sign-in), which this page doesn’t cover. Choose Bring your own client when the identity provider’s documentation has you create an OAuth app, client, or integration and copy its client ID. You also need the secret when that client comes with one and the identity provider offers no public or PKCE-only client type. Otherwise start with Auto-register (dynamic client registration). Single-tenant Microsoft Entra apps and identity providers that publish no discovery document need the extra fields listed under OAuth fields. Test each server yourself before you announce it: sign in to Claude Desktop as a member of the organization and click Connect. The Enterprise Admin Console has no connection test for MCP servers. If the setting doesn’t match the server, Connect fails as described under Troubleshoot sign-in.

Where the client secret goes

Add a client secret only when the identity provider refuses sign-in without one. The console stores a value in Client secret only for a Google OAuth client of the Desktop app type: the value begins with GOCSPX-, Authorization server is exactly ["https://accounts.google.com"], and Tenant ID is empty. Google doesn’t treat a Desktop-app client secret as confidential, so the console accepts it. A Google Web application client’s secret has the same GOCSPX- prefix but is confidential, so always create a Desktop app client. For every other identity provider the secret stays on the device. Install a script that prints the secret, at the same absolute path on every device, and enter that path in the Client secret helper script field. The script must print exactly one JSON object, {"clientSecret": "…"}, on stdout and exit with code 0 within 30 seconds. Claude Desktop runs it each time the server connects or refreshes its sign-in in the background. The console stores only the path, so distribute the script through your device management, as described under When a helper script is the right choice, and see Connect to Box for a minimal script. A configuration delivered by MDM or a bootstrap server can instead carry any identity provider’s secret inline in oauth.clientSecret. Authorization server is required whenever Client secret or Client secret helper script is set. Claude Desktop sends the secret only to the token endpoint of the issuer you name there, so a misconfigured or compromised MCP server can’t redirect the token exchange, and the secret, to another server.

OAuth fields

These fields appear when OAuth is set to Bring your own client. The managedMcpServers reference lists every oauth key and its minimum Claude Desktop version.

Field	When to set	What to enter
Client ID	You registered a client at the identity provider	The client ID from that registration
Client secret	The identity provider requires the secret and the client is a Google Desktop-app client	The secret, beginning `GOCSPX-`
Client secret helper script	The identity provider requires the secret (any identity provider)	The absolute path of the script on the device. Set this or Client secret, not both; in a configuration file that sets both, the script wins
Authorization server	Required with a secret or secret helper script. Optional otherwise, to pin sign-in to a known issuer	A JSON array holding the authorization server’s `issuer` value exactly as its metadata states it, for example `["https://accounts.google.com"]` (no trailing slash) or `["https://api.box.com"]`
Authorization URL and Token URL	The identity provider publishes no discovery document	Both HTTPS endpoints, always as a pair. Hidden when Tenant ID or Authorization server is set
Tenant ID	The client is a single-tenant Microsoft Entra app	Your Directory (tenant) ID. Requires Scope
Scope	Required with Tenant ID. Optional otherwise	Space-separated scopes for the authorize request. Leave empty to request the scopes the server advertises
Sign-in flow	Shown after you enter Tenant ID. Set it when your devices have the OS identity broker	OS identity broker (WAM / Company Portal). The default is System browser
Callback host and Callback port	The redirect URI you registered uses `localhost` or a port other than `53280`	The host and port from that registration. Microsoft Entra ID accepts any loopback port, so leave both empty for Entra
Additional redirect referrer hosts	The identity provider completes sign-in from a host other than the one in its authorization URL, and `main.log` names a rejected referrer host	That hostname. Separate several with spaces

Settings for common servers

Add each server in this table with Add → Blank, the Streamable HTTP transport, and the values shown.

Server	URL	OAuth setting	What you register
Linear	`https://mcp.linear.app/mcp`	Auto-register (dynamic client registration)	Nothing
Notion	`https://mcp.notion.com/mcp`	Auto-register (dynamic client registration)	Nothing
Sentry	`https://mcp.sentry.dev/mcp`	Auto-register (dynamic client registration)	Nothing

These messages appear in Claude Desktop, or in main.log in the logs directory on the user’s device.

What the user sees or `main.log` records	Cause	Fix
”Couldn’t connect to {server} because it doesn’t support automatic client registration” (Claude Desktop 2.110.0 or later), or `main.log` records that the authorization server does not support dynamic client registration	OAuth is Auto-register but the identity provider requires a client that you register	Register a public client with redirect URI `http://127.0.0.1:53280/callback`, set OAuth to Bring your own client, and fill in Client ID
The browser step succeeds, then the connection fails and `main.log` records the token endpoint’s error, for example `client_secret is missing`	The entry has a Client ID but the identity provider also requires the secret	Add the secret and Authorization server as described under Where the client secret goes
`main.log` names a rejected referrer host during sign-in	The identity provider completes sign-in from a host other than the one in its authorization URL	Add that hostname to Additional redirect referrer hosts

Connect to Google Cloud and Connect to Box walk through two servers that need a client you register and its secret. Connect to GitHub and Connect to Microsoft 365 cover those connectors end to end, including the built-in servers that run inside the app. Some partners publish a plugin marketplace rather than an MCP server; add those on the Plugins page, as described under Plugin marketplaces.

​Choose the OAuth setting

​Where the client secret goes

​OAuth fields

​Settings for common servers

​Troubleshoot sign-in

​Related connector guides

Choose the OAuth setting

Where the client secret goes

OAuth fields

Settings for common servers

Troubleshoot sign-in

Related connector guides