Skip to main content

MCP Authentication

FunnelStory authenticates MCP clients using OAuth 2.0 with PKCE. This is the same browser-based authorization flow used across enterprise software — your credentials stay in FunnelStory, and the client receives a scoped access token.

The Authorization Flow​

When an MCP client connects for the first time:

  1. The client fetches OAuth metadata from /.well-known/oauth-authorization-server to discover FunnelStory's authorization endpoints
  2. The client registers itself using Dynamic Client Registration (DCR) — no manual setup needed
  3. The client redirects you to FunnelStory's authorization page
  4. You log in (if not already) and approve the access request
  5. The client exchanges the authorization code for an access token
  6. The client uses that token for all subsequent requests to /api/mcp

After the initial setup, the client refreshes its token automatically. You won't need to re-authorize unless you revoke access.

PKCE​

PKCE (Proof Key for Code Exchange) protects the authorization flow in environments where a static client secret can't be kept confidential — like desktop apps. It prevents authorization codes from being used even if they're intercepted mid-flow.

Revoking Access​

To remove a client's access to your workspace:

  1. Go to the profile menu (avatar) → MCP Clients
  2. Find the client and click the delete icon

The client's tokens are invalidated immediately.

For Custom MCP Clients​

If you're integrating a custom client with FunnelStory's OAuth server:

EndpointStandard
/.well-known/oauth-authorization-serverRFC 8414
/.well-known/oauth-protected-resourceRFC 9728

Dynamic Client Registration is supported — clients discover the registration endpoint from the server metadata.

Next Steps​