DigiUsher DocumentationAuthentication
How OAuth 2.0 authentication works with the MCP Server
The DigiUsher MCP Server uses the OAuth 2.0 authorization code flow through OpenID Connect. OAuth 2.0 is a standard that gives an application access to your data without your password.
How it works
- You connect for the first time from an MCP client, such as Claude.ai or Claude Desktop. The client sends you to the identity provider of DigiUsher.
- You sign in with your DigiUsher credentials. These are the credentials that you use at app.digiusher.com.
- After you sign in, the MCP server gets an access token for your account.
- Every tool call after this uses the token to read data for you.
The MCP server never sees your password and never stores it. The identity provider does all the authentication.
What the server can access
- The server reads only your data. It reads only the organizations and the resources that your DigiUsher account can view.
- Every tool is read-only. The server never changes your cloud infrastructure, your DigiUsher configuration, or your account.
- The MCP server uses the same permission model as the DigiUsher web application.
The server supports dynamic client registration. Most MCP clients can therefore register themselves, and you do not have to do anything. The server publishes its OAuth endpoints under the /mcp prefix: /authorize, /token, /register, and /auth/callback. The OAuth discovery documents stay at the host root, as the specification requires. The server exchanges tokens with the client_secret_post method.
Scopes
The server asks for these OAuth scopes:
| Scope | Purpose |
|---|---|
openid | Standard OpenID Connect authentication |
profile | Access to your user profile (name) |
email | Access to your email address |
Token lifecycle
- Access tokens have a short life and expire automatically.
- Your MCP client refreshes the token for you. You do not have to sign in again during a session.
- To remove the access, disconnect the MCP server in the configuration of your client.
Supported redirect URIs
If you build your own MCP client, the server accepts OAuth callbacks to these URIs:
| URI | Client |
|---|---|
http://localhost:* | Local development tools (any port) |
http://127.0.0.1:* | Local development tools (any port) |
https://claude.ai/api/mcp/auth_callback | Claude.ai |
https://claude.com/api/mcp/auth_callback | Claude.com |
cursor://anysphere.cursor-mcp/oauth/callback | Cursor |
https://chatgpt.com/connector/oauth/* | ChatGPT |
https://chatgpt.com/connector_platform_oauth_redirect | ChatGPT |
https://platform.openai.com/apps-manage/oauth | OpenAI Platform |
https://global.consent.azure-apim.net/redirect/* | Azure API Management |
Privacy and security
- The MCP server does not store user data. It sends the requests to the DigiUsher API and returns the results to you.
- All communication uses HTTPS/TLS encryption.
- The MCP server does not collect conversation content or prompts.
- The full DigiUsher Privacy Policy gives the details.