HomeLiongardRequest a DemoKnowledge Base
Guides

Liongard MCP OAuth Sign-In

Liongard MCP OAuth Sign-In

Overview

OAuth sign-in lets you connect an MCP client to Liongard's Model Context Protocol (MCP) server with a browser sign-in and a one-click approval, instead of creating, copying, and pasting a static Bearer Token into your AI tools. It works the same way as connecting an AI client to Google Drive or GitHub.

Access is tied to your own Liongard identity, whether you sign in with a password or SAML SSO. Each connection respects MFA and your environment scope, and refreshes automatically so it stays connected.

📘

Bearer Tokens Still Work

OAuth is an additional, preferred way to connect. Existing Bearer Token connections created in Admin > AI Preferences continue to work with no changes. See the Liongard MCP Server Integration Guide for Bearer Token setup.

Feature Highlights

  • No Copied Bearer Tokens
    You can sign in through the browser and approve the client. There is no static token to create, paste into config files, or rotate by hand.

  • SSO and MFA Aware
    Consent runs on your existing Liongard login, so SAML SSO users connect with no extra setup. MFA can be required at consent.

  • Automatic Tenant and Environment Scoping
    Your tenant comes from your Liongard session, and your environment scope is applied at consent.

  • Least-Privilege Scopes
    Clients request only the mcp.read and mcp.write scopes, which are shown on the consent screen with Approve and Deny options.

  • Zero-Config Client Setup
    Clients register themselves and discover Liongard's OAuth settings automatically. You only need the MCP server URL.

  • Stays Connected
    Clients use short-lived access tokens with rotating refresh tokens, so the connection stays active without signing in again. Access can be revoked at any time.

Prerequisites

  • Liongard MCP Subscription
    An active LiongardIQ and Liongard MCP subscription.

  • OAuth Enabled for Your Tenant
    OAuth sign-in is enabled per service provider. Contact your Account Manager if you don't see the consent screen when you authenticate.

  • Liongard User Account
    A Liongard login (password or SAML SSO). The connection uses your account's existing environment access.

  • An MCP Client That Supports OAuth
    For example, Claude Code, OpenAI Codex, Zed, or Microsoft Copilot Studio.

How to Use

  1. Add the Liongard MCP server to your MCP client using your tenant's URL:

    https://[server].app.liongard.com/api/mcp

    Replace [server] with your tenant prefix.

  2. Choose Authenticate in your client. The client discovers Liongard's OAuth settings and registers itself automatically.

  3. A browser window opens to Liongard. Log in if prompted, review the client name and requested scopes, and click Approve (or Deny).

  4. Return to your client and ask it to "List the Liongard MCP tools" to confirm the connection.

The client stays connected and refreshes its token automatically.

Supported Clients

ClientHow It Connects
Claude Codeclaude mcp add --transport http ..., then /mcp > Authenticate
Microsoft Copilot StudioTools > + Add > Model Context Protocol (MCP), with OAuth 2.0 authentication
OpenAI CodexSettings > Plugins > MCPs > Add MCP server (Streamable HTTP), then Authenticate
ZedSettings > MCP Servers > Add Remote Server, then Authenticate

Claude Code

  1. Open Claude Code in your terminal.

  2. Register the Liongard MCP server:

    claude mcp add --transport http liongard https://[server].app.liongard.com/api/mcp

  3. Run /reload-plugins.

  4. Enter /mcp to list your MCP servers.

  5. Use the arrow keys to select the Liongard MCP server, press Enter, then select Authenticate.

  6. A browser window opens. Click Approve. Claude Code displays a confirmation once authorization completes.

  7. Close the browser tab and return to Claude Code. Ask Claude to list the tools available from the Liongard MCP to confirm the connection.

Microsoft Copilot Studio

  1. Click Agents, then New Agent.

  2. Name your agent and select your model.

  3. Click Tools, leave the search field blank, and click + Add.

  4. Select Model Context Protocol (MCP).

  5. Enter the following:

    1. Server name and Server description: Enter values that describe the connection.
    2. Server URL: https://[server].app.liongard.com/api/mcp
    3. Authentication: Select OAuth 2.0.
    4. Configuration type: Select Dynamic (with discovery).

  6. Click Add. After it connects, open the dropdown and select Create new connection.

  7. Click Create. A Liongard window opens. Click Approve to authorize access, then click Add.

  8. Test the connection in Preview by asking the agent to list the available tools and count your environments.

  9. Choose Publish to share the agent with other users.

For Bearer Token setup in Copilot Studio, see Microsoft Copilot Studio.

OpenAI Codex

  1. Open Settings from the bottom-left menu, then go to Plugins > MCPs.

  2. Click Add > Add MCP server.

  3. Enter the following:

    1. Name: Enter a name for the Liongard MCP server connection.
    2. Type: Select Streamable HTTP.
    3. URL: https://[server].app.liongard.com/api/mcp

  4. Leave the remaining fields blank and click Save.

  5. Codex returns you to the server list with the new connection enabled. Click Authenticate.

  6. A browser window opens. Click Approve. When you see Authentication complete. You may close this window., return to Codex.

  7. Start a new conversation and ask Codex to "List the Liongard MCP tools" to confirm the connection.

Zed

  1. Click your avatar in the top-right corner and select Settings.

  2. Scroll to MCP Servers and click Configure.

  3. Click + Add Server and select Add Remote Server.

  4. Enter a server name and your URL: https://[server].app.liongard.com/api/mcp

  5. Click Save. Zed returns you to the Configured Servers list.

  6. Click Authenticate. A browser window opens. Click Approve.

  7. Close the browser tab and return to Zed. The server now shows Logout instead of Authenticate.

  8. Open an Agent Thread from the sparkle icon in the footer and ask Zed to list the available tools from the Liongard MCP.

Use Cases

  • Onboard a Technician in Under a Minute
    A new technician connects their AI client with a single browser approval, with no Bearer Token to create, store, or rotate.

  • Meet SSO and MFA Requirements
    Partners who mandate SAML SSO and MFA no longer need a static Bearer Token exception for MCP access.

  • Attribute MCP Activity to a Person
    Tokens carry the user's identity, tenant, and environment scope, so MCP activity is tied to a user rather than a shared token. Offboarding a user removes their access path.

Security Notes

  • Token Lifetime
    Access tokens are short-lived. Refresh tokens expire after 30 days and rotate each time they are used.

  • Local Token Storage
    Your MCP client stores an access token and a refresh token on your machine, in a keychain or credentials file depending on the client. Exposure is limited because tokens are scoped, short-lived, and revocable, but a copied refresh token works until it expires or is revoked.

  • Debug Logging
    Some clients log the Authorization header when running in debug mode. Avoid sharing debug logs.

  • No Permission Expansion
    Tokens are limited to mcp.read and mcp.write and your existing environment scope.

Current Limitations

  • OAuth does not replace Bearer Tokens. Static Bearer Token access remains supported.
  • OAuth does not change how you log in to Liongard. Consent uses your existing login.
  • OAuth is user-delegated and interactive. It is not a service-account or unattended authentication method. Use a Bearer Token for unattended automations such as n8n workflows.

Updated about 1 hour ago

Did this page help you?