MCP Gateway Authentication

Each client proves who it is before the gateway shows any tools. Pick the method by the client you have:

Your client	Use	Each call acts as
Claude Code, Cursor, or another MCP client	OAuth: the client opens a browser for you	The person who signs in
A script or CI job	Platform token: one header	You, a team, or the organization
A client that already holds a token from your identity provider	Identity provider JWT: pass that token	The person in the token
Your own app or service	OAuth client: the app gets its own identity	The app, or the person using it

Not sure? Use OAuth. It works with any MCP client. By default, you register nothing in Archestra first.

OAuth

Paste the gateway's URL into your client. It opens your browser, you sign in, and the tools appear. You register nothing in Archestra first. Each client signs in as the person, and gets only that person's tools.

Copy the endpoint from the gateway's Connect tab into your client.
Sign in to Archestra in the browser, and approve the client.
Check that the client lists the gateway's tools.

A client registers itself in one of two ways. Archestra supports both, so any MCP client works:

Client ID Metadata Document: the client's ID is a URL that describes it. Newer clients use this.
Dynamic Client Registration: the client registers itself the first time it connects.

To allow only clients you register yourself, set ARCHESTRA_AUTH_DCR_ENABLED=false. That turns off both. Then register each client as an OAuth client.

Platform Token

For a script or a CI job: one header, no browser. The client gets the tools the token's owner can use.

text

Authorization: Bearer arch_<token>

Token	Find it under	Calls act as
Personal Token	Your name in the sidebar	You, with your own server accounts
Team	Settings → Teams	The team, with its shared accounts
Organization Token	Settings → Auth	The organization, with its shared accounts

The gateway's Connect tab also shows your tokens, ready to copy.

Keep a token secret. Anyone who has it acts as its owner. Click Rotate Token if it leaks.
Team and organization tokens have no person behind them. They cannot use per-person tools, such as knowledge search.
For your own app, use an OAuth client instead. Its tokens expire, and you can limit what it reaches.

Identity Provider JWT

Already signed in to Okta or Entra ID? Send that token. Nobody needs an Archestra token. Use it for an internal app or agent platform that signs people in through your company's single sign-on. Identity providers are an Enterprise feature. See Licensing.

The call acts as the person in the token. So it can use their own server accounts, and Archestra can exchange their identity for a token each MCP server accepts.

Add your OIDC provider under Settings → Identity Providers. See Identity Providers.
On the gateway, go to Advanced and pick that provider.
In your client, send the token the provider issued:
text
```
Authorization: Bearer <jwt>
```
Check that the client lists the gateway's tools.

Archestra accepts the token only when:

It is genuine. The signature, issuer, and expiry check out against the provider's published keys.
It is for Archestra. Its audience is the provider's client ID in Archestra.
It names a known person. Its email matches an Archestra user who can use the gateway. If your provider puts the email in a custom claim, set Email Claim under the provider's Attribute Mapping.

Token rejected? Open the provider and go to Token Debugger. It shows the claims of your own latest sign-in, so you can see which claim holds the email.

ID-JAG

ID-JAG lets your identity provider decide which MCP servers each person can use. It is the core of MCP's Enterprise-Managed Authorization extension. Nobody approves each server one by one:

The person signs in once, through your company's single sign-on.
The client asks your identity provider for an ID-JAG for one MCP server. The provider checks its access policy first.
The client trades the ID-JAG for that server's access token.

Archestra plays the client role today, not the server role. It gets ID-JAGs from your identity provider to authenticate to MCP servers for a person. See MCP Server Credentials. The gateway does not accept an ID-JAG yet.

Gateway support waits on the Identity Continuation Assertion draft. Without it, Archestra cannot pass the person's identity on to the next server after it accepts an ID-JAG.