MCP OAuth2 Client Credentials rule

Authenticates MCP Server requests by validating OAuth2 access tokens using the Client Credentials grant flow. The rule fetches signing keys from the authorization server's URL and verifies the token before allowing the request to proceed.

The OAuth2 Client Credentials flow enables application-to-application authentication without user interaction. The client application obtains an access token from the authorization server using its Client ID and Client Secret, then includes that token in MCP requests.

Before allowing access to the MCP Server, the rule does the following:

Validates the access token against the authorization server.
- If valid, processes the request.
- If invalid or expired, rejects the request.

The OAuth2 Client Credentials rule works with the Authorize by Role rule. Configure the Roles Expression to extract role information from the token response, then use those roles in the Authorize by Role rule.

Policy execution order

The MCP OAuth2 Client Credentials rule executes after early-stage request validation rules, such as IP Restriction, and before the request is routed to the MCP Server pipeline.

Token caching

Validated tokens are cached for the duration specified in Time-To-Live in Seconds. During this period, subsequent requests using the same token do not require re-validation against the authorization server.

Note: All expression-enabled fields accept expressions from the SnapLogic Expression Language.


Field/Field set	Description
When this policy should be applied	Boolean that determines when this policy should be applied to a request. Default value: Example:
Auth domain	URL for fetching the keys for verifying the JWT Token. Default value: N/A Example: https://test-example.us.auth0.com
Client ID	Required. The Client ID for the OAuth2 application on the provider. Default value: N/A Example: `cL0WOQBez3xPhCATbd1ITtvV3neRm2Y5`
Client Secret	Required. The Client Secret for the OAuth2 application. Default value: N/A Example: Value is encrypted
Extract keys from URL	How to extract the keys from the URL response entity. Default value: `$.keys` Example: `$.keys`
Extract User Info	Required. Extract username and roles for authentication.
Roles Expression	Required. An expression that will extract the roles from the User Info URL responses. Default value: N/A Example:
User ID Expression	Required. An expression that will extract the user ID from the User Info URL responses. Default value: N/A Example: $.xyz
Time-To-Live in Seconds	Required. How many seconds the token is valid for before it will be re-validated. Default value: 600 Example: 600
Description	The purpose of the rule.