Auth for MCP

Ship your MCP server.
‍Not an OAuth implementation.

Drop-in OAuth 2.1 for any MCP server. Bring your existing auth — users connect from Claude, ChatGPT, and Cursor in days.

TAlk to our team

View docs

Where it runs

Two reasons teams add MCP auth.
‍Not in code, not in context.

Tokens live in a vault inside your deployment. The gateway injects the credential at call time, so the agent calls the tool, never the token.

Policy before execution

CIMD prevents phishing at registration. Servers verify the client's actual domain — not just what it claims.

Validate anywhere

RS256-signed JWTs validate at Kong, AWS API GW, or Cloudflare Workers without a live Scalekit call.

Works with any MCP client

Claude

ChatGPT

Cursor

Windsurf

Any MCP client

Supported access patterns

OAuth credentials

Client credentials

Token cascade

Bring your own auth

Your existing auth stays.
‍Exactly as it is.

Don't migrate users. Don't rebuild your login flow. Scalekit is the OAuth layer — your existing system handles identity.

Redirect to your login

Any auth request is sent to your existing login page — unchanged.

Your system authenticates

SSO, password, magic link — whatever you already run.

Return sub. Get token.

One backend call. Scalekit handles consent, token lifecycle, and refresh.

Works with

Auth0

Okta

Keycloak

AWS Cognito

Firebase

Custom

Enterprise

Make your MCP server
XAA-ready.

Cross-App Access lets your customers' enterprise IdPs authorize agents directly. Admins configure once — no per-user OAuth flows, no long-lived keys.

Learn more

Agents present a signed identity assertion from their IdP. Scalekit exchanges it for a short-lived, scoped token.

Admin configures once. All users in mapped groups inherit access automatically.

Every token request logged through the IdP's existing audit trail — one control plane for all agent access.

CUSTOMERS

Teams shipping agents to production.

“I wanted to get the OAuth layer done without burning a full sprint rebuilding infrastructure we'd already built. Scalekit let us add auth to the existing server, configure the right permissions per tool from a dashboard, and move on. We didn't have to migrate to a new framework or touch the core logic.”

Kartikay Dhar

Director of Product, AI · Sprouts.ai