MCP Authentication

The /mcp endpoint requires a Bearer token in the Authorization header. MCP clients obtain one automatically through the OAuth 2.1 PKCE flow — there’s no API key to create, paste, or rotate. You can also supply a token manually for testing.

OAuth 2.1 PKCE flow

Flowstep runs its own OAuth 2.1 authorization server at https://api.flowstep.ai. MCP clients discover and complete the flow automatically: they open a browser window for you to log in and approve access, then handle the token exchange behind the scenes. Clients can register themselves dynamically, so you don’t need to set up a client ID first. The authorization page at /oauth/authorize supports:

Email/password — any Flowstep account with a password set
Google SSO — redirects through Supabase social auth, returns to the client automatically

Review and approve access

After you log in, Flowstep shows a consent screen before it issues a token — no client can finish connecting without your explicit approval. The screen is headed Authorize access and names the client that’s requesting access — the client’s name in bold, followed by “is requesting access to your Flowstep account” — then shows You’ll be redirected to and the destination host. Choose Allow to finish connecting, or Deny to cancel. Denying returns the client an access_denied error and issues no token.

The client name is set by whoever registered the client, so treat it as a label rather than proof of identity. Before you click Allow, check that the host under You’ll be redirected to is one you expect for the client you’re connecting.

Account creation for claude.ai connector users

The OAuth login page does not include a sign-up form. If you’re adding the Flowstep connector from Claude’s connector directory and don’t have a Flowstep account yet, create one first at app.flowstep.ai, then return to Claude to finish connecting. If no Authorization header is present, the middleware falls back to a cookie-based Supabase session. This works when accessing /mcp directly from a browser with an active Flowstep session. MCP clients always use the Bearer path.

Manual token (testing)

To call the endpoint directly without a client OAuth flow:

Sign in to app.flowstep.ai in your browser
Open DevTools → Console, run:

const pairs = document.cookie.split("; ").map((c) => {
  const i = c.indexOf("=");
  return [c.slice(0, i), c.slice(i + 1)];
});
const authPairs = pairs
  .filter(([k]) => /^sb-.+-auth-token(\.\d+)?$/.test(k))
  .sort(([a], [b]) => a.localeCompare(b));
const raw = authPairs.map(([, v]) => decodeURIComponent(v)).join("");
const session = JSON.parse(
  raw.startsWith("base64-") ? atob(raw.slice(7)) : raw,
);
console.log(session.access_token);

Pass the token as a header:

curl -X POST https://api.flowstep.ai/mcp \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

MCP sessions last 30 days — the server refreshes the underlying token transparently, so clients using the OAuth flow don’t need to re-authenticate during normal use. A manually extracted token like the one above still expires after about an hour; it’s for quick testing only.

Get Started

Using Flowstep

Teams & Organizations

Exporting & Integrations

MCP Server

Billing & Plans

Security & Privacy

MCP Authentication

OAuth 2.1 PKCE flow

Review and approve access

Account creation for claude.ai connector users

Manual token (testing)

​OAuth 2.1 PKCE flow

​Supported login methods

​Review and approve access

​Account creation for claude.ai connector users

​Cookie fallback

​Manual token (testing)

OAuth 2.1 PKCE flow

Supported login methods

Review and approve access

Account creation for claude.ai connector users

Cookie fallback

Manual token (testing)