Enable MCP and register clients

This topic covers one-time OpenText Software Delivery Management-side setup required to enable MCP register clients.

In this topic:

Authentication options

MCP supports two authentication methods.

Authentication method	Best for
OAuth 2.1	User-based login flows (for example, desktop IDE clients) with short-lived access tokens and long-lived refresh tokens.
API access key	Simple setups, service-style access, and clients configured with a static token.

API access key authentication

Create an API access bearer token in the target space and configure the client with the generated token. Use Token type.

For details, see API access.

OAuth 2.1 authentication

OAuth 2.1 lets AI clients authenticate as a real OpenText Software Delivery Management user through a browser login, without storing long-lived credentials in config files.

MCP clients obtain an access token through the OAuth 2.1 authorization code flow and present it in the Authorization header of requests: Authorization: Bearer <access-token>

OAuth 2.1 metadata is available at: <server>/.well-known/oauth-authorization-server

The following site parameters must be set:

Parameter	Value
OAUTH_AUTHORIZATION_SERVER_ENABLED	true
OAUTH_AUTHORIZATION_SERVER_CLIENTS	A JSON array, each block describing a client. See details below.

For details on setting site parameters, see Configuration parameters.

Register MCP clients

Every AI client that uses OAuth must be pre-registered in the OAUTH_AUTHORIZATION_SERVER_CLIENTS site parameter. Unregistered clients are rejected at the authorization endpoint. Only public OAuth clients are supported, as defined in RFC 8252 section 8.4.

JSON entry format for a client:

[
  {
    "client_id":    "<unique-id-for-this-client>",
    "client_name":  "<human-readable-name>",
    "redirect_uris": ["<callback-uri-1>", "<callback-uri-2>"]
  }
]

Field	Description
client_id	Unique identifier. Must match the client_id the MCP client sends in its OAuth request. Must be unique across all entries. Duplicate client_id values are rejected. The parameter save will fail validation if two entries share the same client_id.
client_name	A label or description to help you identify what this client is for.
redirect_uris	Non-empty array of allowed callback URIs. Requests with an unregistered redirect_uri are rejected.

Changes to OAUTH_AUTHORIZATION_SERVER_CLIENTS take effect immediately. No server restart is required.

Redirect URI rules

• Loopback URIs (http://127.0.0.1/..., http://localhost/..., http://[::1]/...) are stored and matched without a port number: any port is accepted at request time. This behavior is defined in RFC 8252 section 7.3 and is required for desktop clients that pick a random free port.
• Non-loopback URIs must match the registered value exactly (scheme, host, port, and path).

Redirect URIs by client

Use the redirect URIs in the table below as a starting point. Verify against your client version's documentation, as they can change between releases.

Client	Typical redirect_uris to register
Claude Desktop	http://127.0.0.1/oauth/callback, http://localhost/oauth/callback
VS Code with GitHub Copilot	vscode://github.copilot-chat/oauth/callback, vscode-insiders://github.copilot-chat/oauth/callback
IntelliJ with GitHub Copilot	http://127.0.0.1/callback, http://localhost/callback
Cursor	http://127.0.0.1/oauth/callback, http://localhost/oauth/callback

Register all URIs a client may use. Include both loopback variants for desktop clients that may use either 127.0.0.1 or localhost.

Example — registering Claude Desktop, VS Code Copilot, and IntelliJ Copilot:

[
    {
        "client_id": "sdp_claude",
        "client_name": "claude_desktop",
        "redirect_uris": [
            "http://localhost:3334/oauth/callback"
        ],
        "scope": "mcp"
    },
    {
        "client_id": "copilot_sdp_vsc",
        "client_name": "GitHub Copilot",
        "redirect_uris": [
            "http://127.0.0.1:33418/",
            "https://vscode.dev/redirect"
        ]
    },
    {
        "client_id": "copilot_sdp_INTELLIJ",
        "client_name": "GitHub Copilot",
        "redirect_uris": [
            "http://127.0.0.1/callback",
            "http://localhost/callback"
        ]
    }
]