OAuth Authorization Server

The OAuth Authorization Server screen lets you configure Kuroco to act as an OAuth 2.0 / OpenID Connect authorization server. You can issue authorization codes and access tokens to external OAuth clients (including MCP clients). Each OAuth Authorization Server setting can have multiple OAuth Authorization Server clients registered under it.

OAuth Authorization Server list

Accessing the screen

In the left sidebar menu, under "SETTINGS", click [External system integration] -> [OAuth Authorization Server].

Field descriptions

Field	Description
Enabled	Status of the OAuth Authorization Server. : Enabled : Disabled
Name	Name of the OAuth Authorization Server. Click it to open the editor.
Target Domain	The target domain (purpose) of this authorization server: one of API / Management / AdminMCP.
OAuth Authorization Server Client	Click [Manage Clients] to open the list of clients bound to this authorization server.
Updated on	Date and time of the last update.

On the list screen, you can enable, disable, or delete the authorization servers selected with the checkboxes in bulk.

OAuth Authorization Server editor

Accessing the screen

In the left sidebar menu, under "SETTINGS", click [External system integration] -> [OAuth Authorization Server]. To create a new authorization server, click [Add] at the top right of the list screen. To edit an existing setting, click the [Name] of the authorization server you want to edit on the list screen.

Item descriptions

OAuth Authorization Server editor

Item	Description
Name	Name of the OAuth Authorization Server. (Required)
Target Domain	Purpose of this authorization server. API: member-facing authorization server. Management: admin-facing authorization server. AdminMCP: admin-facing authorization server whose tokens are bound to the Admin MCP resource. (Required) Note: The target domain cannot be changed after creation. The editor shows a [Can't edit] badge. Changing it would desync the stored allowed scopes, grant types, and resource binding.
Client ID Metadata Documents (URL client IDs)	When enabled, an HTTPS URL is accepted as client_id and the client metadata is fetched from that URL. The metadata (such as the app name) is self-declared by the client and is not verified; the consent screen shows the URL as the trust anchor.
Supported Grant Types	Check the OAuth grant types this authorization server supports (at least one required). authorization_code: authorization code flow. refresh_token: reissue via refresh token. client_credentials: token issuance via client credentials. By default, authorization_code and refresh_token are selected.
Allowed Scopes	Check the scopes this authorization server is allowed to issue (the upper bound a client may request). Only the selected scopes can be assigned to clients and granted in tokens. Be sure to select the scopes you intend to use — if none are selected, no scope can be assigned to a client. The available scopes depend on the target domain (see Scope list).
OAuth Authorization Server Client	Click [Manage Clients] to open the list of clients bound to this authorization server. (Shown only for saved authorization servers.)
API endpoint	Lists the API endpoints whose MCP server is bound to this authorization server. Click an API to open its editor. (Shown only for a saved authorization server with target domain API.)
Access Token TTL	Lifetime of the access token, in seconds (minimum 60). Default is 3600 seconds.
Refresh Token TTL	Lifetime of the refresh token, in seconds (minimum 60). Default is 2592000 seconds.
Authorization Code TTL	Lifetime of the authorization code, in seconds (minimum 10). Default is 60 seconds.
Sort	Display order in the list, as a number.
Enabled	Check to enable this setting.
Login Page URL	For target domain API, the path of the login page used for sign-in (e.g. /login/). (Required when the target domain is API.) For Management / AdminMCP, this field is hidden and the admin panel login URL is used automatically.
Issuer URL	Issuer URL of this authorization server (read-only). Shown only for saved authorization servers.
Metadata URL	URL of this authorization server's metadata (Authorization Server Metadata) (read-only). Shown only for saved authorization servers.

Actions

Button	Description
Update	Save the entered content.
Delete	Delete the OAuth Authorization Server setting shown.

Scope list

The scopes available under "Allowed Scopes" depend on the target domain.

Target Domain	Available scopes
API	Sign-in scopes (openid / profile / email), plus API read access (api:read) and API write access (api:write)
Management	Sign-in scopes only (openid / profile / email)
AdminMCP	Sign-in scopes, plus the Admin MCP capability level and resource (module / content) scopes

Admin MCP capability levels

When the target domain is AdminMCP, select one Admin MCP capability level from the following.

Capability level	Scope	Description
Read-only	mcp:tools.read	Can use read tools.
Read & write	mcp:tools.write	Can use read and write tools.
Full access	mcp:admin	Includes all operations such as token generation, and bypasses content/module restrictions.

When "Read-only" or "Read & write" is selected, choose at least one target content or module. To target everything, select "All modules (including ones added later)" or "All content (including ones added later)". When "Full access" is selected, content/module restrictions are bypassed, so these selections are hidden.

caution

Only one authorization server with target domain Management and one with AdminMCP can be enabled site-wide at a time, because each resource server resolves exactly one enabled setting. (API may have several, since each MCP-enabled API binds to one authorization server individually.)

OpenID Connect (sign-in information)

When sign-in scopes (openid / profile / email) are granted, this authorization server acts as an OpenID Connect authorization server and releases the member's sign-in information (claims) to the client. id_token issuance and claim retrieval from the userinfo endpoint are enabled only when the granted scope contains openid. For details on id_token, the userinfo endpoint, the JWKS endpoint, and more, see OpenID Connect support for OAuth Authorization Server.

OAuth Authorization Server Client

Multiple clients can be registered under one OAuth Authorization Server. A client holds the OAuth Authorization Server client ID, secret, redirect URIs, scopes, and so on.

OAuth Authorization Server client list

Accessing the screen

Click [Manage Clients] from the OAuth Authorization Server list screen or the OAuth Authorization Server editor.

Field descriptions

Field	Description
Enabled	Status of the client. : Enabled : Disabled
Client Name	Name of the client. Click it to open the editor.
Client ID	The client ID.
Token Endpoint Auth Method	The token endpoint authentication method of the client.
Updated on	Date and time of the last update.

OAuth Authorization Server client editor

Accessing the screen

Click [Add] at the top right of the client list screen to create a new client. To edit an existing client, click the [Client Name] on the list screen.

Item descriptions

Item	Description
Client Name	Name of the client. (Required)
Client ID	The client ID issued after saving (read-only).
Enabled	Check to enable this client.
Token Endpoint Auth Method	Authentication method of the client. (Required) none: public client (PKCE only). client_secret_basic: sends the client secret in the Basic authentication header. client_secret_post: sends the client secret in the request body.
Client Secret	Check [Regenerate client secret on save] to generate a new secret on save and show it once on screen. The previous secret is invalidated. (Shown only when editing an existing client.)
Redirect URIs	Enter one allowed redirect URI per line. (Required) Common MCP client callbacks: https://claude.ai/api/mcp/auth_callback https://chatgpt.com/connector_platform_oauth_redirect
Service member ID	Member ID used as the token subject for client_credentials access tokens. The same permission check as token generation is applied on save. (Shown only when the parent authorization server enables client_credentials.)
Allowed Scopes	Use the tabs on the left to switch between [Supported Grant Types] and each scope group. Under [Supported Grant Types], check the grant types this client uses (at least one required). Grant types disabled at the parent authorization server are shown as [disabled at authorization server level] and cannot be selected. In each scope group, select the scopes to assign to this client. The selectable scopes are limited to the range allowed by the parent authorization server's [Allowed Scopes].

When a new client secret is generated on save, the secret is shown at the top of the screen with the following message.

This client secret is shown only once. Copy and store it securely now — it cannot be retrieved later.

caution

The client secret is shown only once, on save. It cannot be retrieved later, so copy and store it securely when it is shown.

caution

API / MCP clients require at least one access scope. Identity-only scopes (such as openid) cannot reach the API / MCP.

Notes

• The target domain cannot be changed after the authorization server is created. To change the target domain, create a new authorization server.
• Only one authorization server with target domain Management and one with AdminMCP can be enabled site-wide at a time.
• The scopes and grant types assignable to a client are capped by the range allowed at the parent authorization server. Scopes and grant types not allowed at the authorization server cannot be selected on the client.
• The client secret is shown only once on save and cannot be retrieved later.

Related documents

• OpenID Connect support for OAuth Authorization Server
• OAuth SP
• SAML IdP
• Can I use single sign-on using OAuth?