BoldDesk MCP Server Authentication Using OAuth 2.0
The BoldDesk MCP Server supports OAuth 2.0 Authentication (Beta), enabling users to securely authorize MCP-compatible applications without sharing API keys. OAuth 2.0 provides token-based authentication with user consent and scoped access. OAuth 2.0 is recommended for AI assistants, IDE extensions, and third-party applications that require user-authorized access to BoldDesk resources.
How OAuth 2.0 Authentication Works
OAuth 2.0 uses a delegated authorization model. During the authorization process:
- The application requests access to BoldDesk.
- The user signs in to their BoldDesk account.
- The user reviews and approves the requested access.
- BoldDesk issues authorization tokens.
- The application uses the issued tokens when communicating with the MCP Server.
- This approach allows applications to access authorized resources without requiring users to share API keys.
Configuring OAuth 2.0 Authentication
Follow the steps below to configure MCP OAuth 2.0 authentication.
- Navigate AI > AI Agent & Tools > MCP Server > MCP Configuration.
- Toggle on MCP configuration.
- Enable OAuth 2.0 authentication.
- Connecting an OAuth-Compatible Client
- Once OAuth 2.0 authentication is enabled, initiate the MCP connection from a supported MCP client application. The client redirects users through the authorization flow to obtain consent and access tokens.
Authorize Access
After initiating the MCP connection, review the requested permissions and approve access. After authorization is completed, the client can access approved resources through the MCP Server.
Connected OAuth Clients
The Connected OAuth Clients section displays applications that have been authorized to access the MCP service. For each client, administrators can view the following;
| Field | Description |
|---|---|
| Client Name | Name of the connected application |
| Client ID | Unique identifier assigned to the OAuth client |
| Status | Current status (Active or Revoked) |
| Created On | Date and time when the client authorization was created |
| Action | Option to revoke client access |
Revoking Client Access
Administrators can immediately revoke access granted to an OAuth client. Follow the steps below;
- Open AI > AI Agent & Tools > MCP Server.
- Locate the client in the Connected OAuth Clients list.
- Click Revoke next to the client.
- Confirm the action by clicking on Revoke.
After revoking access, the client will no longer be able to authenticate using its existing authorization.
Monitoring Connected Applications
Use the Connected OAuth Clients list to:
- Review authorized applications.
- Identify active integrations.
- Remove unused or unauthorized clients.
- Audit MCP access across the organization.
The client list supports searching and displays authorization status for each connected application.
Security Recommendations
- Use OAuth 2.0 for user-facing and third-party integrations.
- Use API Keys only for trusted backend services.
- Regularly review connected OAuth clients.
- Revoke access for unused integrations.
- Follow your organization’s credential management policies.
The MCP Configuration feature provides centralized management of MCP authentication and connected AI tooling, helping organizations securely control how external applications access BoldDesk resources.
- OAuth 2.0 Authentication is currently available as a Beta feature.
- Access remains limited to resources authorized for the authenticated user.
- Administrators can centrally manage and revoke OAuth access from the MCP Configuration page.
