> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getarbol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP OAuth

> The two-audience OAuth and on-behalf-of flow for an Arbol user calling API-backed MCP tools.

The MCP server and the Arbol API are separate OAuth resources. A token issued for one audience must not be accepted by the other.

```text theme={null}
AI client
  |  MCP audience token
  v
Arbol MCP
  |  on-behalf-of exchange
  |  API audience token
  v
Arbol API
```

## Request flow

1. The client discovers the MCP protected resource and authorization server.
2. Dynamic client registration creates an approved OAuth client.
3. A person authorizes the MCP client in the context of their organization.
4. The client sends the resulting MCP-audience bearer token to the MCP endpoint.
5. MCP verifies issuer, audience, signature, expiry, organization context, and the MCP access scope.
6. MCP exchanges that verified token for an API-audience token on the person's behalf.
7. MCP calls the generated REST operation with the exchanged token.
8. The API independently verifies organization and operation permissions.

## Required metadata

The deployment must expose and verify:

* MCP protected-resource metadata under `https://mcp.getarbol.com/.well-known/oauth-protected-resource`;
* authorization-server metadata from the configured Auth0 custom domain;
* a dynamic-client-registration endpoint; and
* the downstream API protected-resource metadata at `https://api.getarbol.com/.well-known/oauth-protected-resource`.

## Security invariants

* MCP never forwards the incoming MCP token directly to the API.
* The exchanged token's audience is the API, and its scopes are bounded by the delegated user authority.
* Organization identity comes from verified token claims, never tool arguments.
* Tool execution still receives `401` or `403` from the API when delegated authority is invalid or insufficient.
* Token exchange credentials remain server-side and are never returned through MCP content.

<Warning>
  This flow is a deployment prerequisite, not a statement that dynamic registration and token exchange are already enabled in production.
</Warning>

See Auth0's [MCP on-behalf-of guide](https://auth0.com/ai/docs/mcp/get-started/call-your-apis-on-users-behalf) and [on-behalf-of token exchange documentation](https://auth0.com/docs/secure/call-apis-on-users-behalf/on-behalf-of-token-exchange) for the identity-provider requirements.