Skip to main content

MCP Authentication

The Perspective MCP server supports two authentication mechanisms depending on how you connect.

HTTP endpoint — OAuth2 Bearer token​

When you connect via the remote HTTP endpoint (POST https://api.perspective.co/mcp), every request must include a valid OAuth2 Bearer token:

Authorization: Bearer <token>

The server validates the token against the Auth0 JWKS endpoint. It checks:

  • The token is signed with RS256 and issued by the configured Auth0 tenant.
  • The token audience matches the Perspective API.
  • The token's https://perspective.co/user_metadata claim contains a valid companyId and subscriptionId.

If validation fails the server responds with 401 Unauthorized and a WWW-Authenticate: Bearer header pointing to the OAuth protected-resource metadata document.

OAuth discovery endpoints​

The server exposes standard OAuth2 discovery endpoints that MCP clients use to initiate the authorization flow automatically:

  • GET /.well-known/oauth-protected-resource
  • GET /.well-known/oauth-authorization-server
  • GET /oauth/authorize
  • POST /oauth/register

MCP clients that support dynamic client registration (such as Claude Code) can discover and complete the OAuth flow without manual configuration. For full OAuth documentation see OAuth Overview.

Desktop DXT — API key​

When you use the DXT desktop package, Claude Desktop launches the dist/stdio.js binary with your PERSPECTIVE_API_KEY set as an environment variable. The binary forwards this key to the hosted server in the x-perspective-api-key header on every proxied request.

You never handle OAuth manually in the DXT flow — the binary and server take care of authentication once you supply the key.

Getting an API key​

See API Keys for how to create and manage API keys in the Perspective app. Only workspace Admins can create API keys.

Summary​

Connection methodCredential typeWhere it goes
Remote HTTPOAuth2 Bearer tokenAuthorization: Bearer <token> header
Desktop DXT (stdio)API key (PERSPECTIVE_API_KEY)x-perspective-api-key header (set by DXT binary)