> ## Documentation Index > Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt > Use this file to discover all available pages before exploring further. # Per-person sign-in for MCP connectors > Let one shared agent reach an internal system as whoever is asking: each person signs in once with your identity provider, and your system enforces that person's own permissions on every call **Why:** give a shared agent access to an internal system without a shared service account. Each person signs in once; from then on the agent calls your MCP connector with that person's own token, and your system decides what they may see and do. Two people asking the same agent get different, correct answers, and every call is attributable to the person who made it. **How it works:** 1. The first time a person's request needs the MCP connector, the chat shows a **Sign in to** card for it. They click it and sign in with your identity provider (no password if they already signed in to xpander through it). 2. xpander keeps that person's token in the install's vault and refreshes it. 3. Every call carries `Authorization: Bearer `. The MCP connector checks it and answers as that person. ## Set it up **1. Turn it on (self-hosted).** `client-auth` brokers the sign-in from its published origin. Empty, the default, turns MCP OAuth off. ```yaml theme={"dark"} client-auth: env: CLIENT_AUTH_EXTERNAL_URL: https://client-auth. ``` **2. Create a client at your identity provider.** Confidential, authorization code flow, redirect URI `https://client-auth./mcp_auth/*`, scopes `openid profile email offline_access`. **3. Make the MCP connector accept the token.** Publish your identity provider's endpoints at `/.well-known/oauth-authorization-server` on the MCP connector's own origin (xpander reads it first and requests exactly its `scopes_supported`, so list only your client's scopes). Answer a missing or bad token with `401`. On every call, verify the token and act as the person in it: ```python theme={"dark"} import jwt ISSUER = "https://idp.example.internal/auth/realms/acme" # Keycloak paths shown keys = jwt.PyJWKClient(f"{ISSUER}/protocol/openid-connect/certs") def person_from(authorization_header: str) -> str | None: token = authorization_header.removeprefix("Bearer ").strip() try: key = keys.get_signing_key_from_jwt(token).key claims = jwt.decode(token, key, algorithms=["RS256"], issuer=ISSUER, options={"verify_aud": False}) except jwt.PyJWTError: return None # -> 401 if claims.get("azp") != "acme-inventory-mcp": # only tokens minted for your client return None return claims["email"] # apply this person's permissions ``` **4. Register it for the organization.** **Settings > Skills**, the list of MCP servers, **Add server**: **Shared with** **Organization**, the server URL, **Authentication** **OAuth2**, the client's **Client ID** and **Client secret**. Add server form with Name Acme Inventory, Shared with Organization, Remote, Server URL, HTTP, Authentication OAuth2, Client ID, a masked Client secret and the Redirect URL **5. Attach it to a shared agent.** In the agent's settings, **Add skill**, pick the entry, and give the agent **Org-wide** access. Add a skill panel searching inventory, listing Acme Inventory of type MCP ## What two people see Alice and Bob ask the same agent "What equipment do I have?" for the first time. Each signs in once, then gets only their own equipment. Acme IT Assistant chat as Alice with a Sign in to Acme Inventory card Acme IT Assistant answering Alice with the three items assigned to her Acme IT Assistant chat as Bob with a Sign in to Acme Inventory card Acme IT Assistant answering Bob with the items assigned to him **If it fails:** "MCP OAuth is not available on this deployment." means `CLIENT_AUTH_EXTERNAL_URL` is empty. An invalid redirect URI at the identity provider means the `/mcp_auth/*` callback is not registered. `invalid_scope` means the MCP connector's metadata lists a scope your client does not have. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.