MCP Authentication

The /mcp endpoint requires a Supabase access_token passed as a Bearer token. Most MCP clients obtain this automatically via the OAuth 2.1 PKCE flow. You can also supply a token manually for testing.

OAuth 2.1 PKCE flow

Flowstep implements a full OAuth 2.1 authorization server at https://api.flowstep.ai. MCP clients discover and complete the flow automatically: they open a browser window for you to log in, then handle the token exchange behind the scenes. The authorization page at /oauth/authorize supports:

Email/password — any Flowstep account with a password set
Google SSO — redirects through Supabase social auth, returns to the client automatically

Account creation for claude.ai connector users

The OAuth login page does not include a sign-up form. If you’re connecting via claude.ai’s custom connector and don’t have a Flowstep account yet, create one first at app.flowstep.ai, then return to the connector setup to authenticate. If no Authorization header is present, the middleware falls back to a cookie-based Supabase session. This works when accessing /mcp directly from a browser with an active Flowstep session. MCP clients always use the Bearer path.

Manual token (testing)

To call the endpoint directly without a client OAuth flow:

Sign in to app.flowstep.ai in your browser
Open DevTools → Console, run:

const pairs = document.cookie.split("; ").map((c) => {
  const i = c.indexOf("=");
  return [c.slice(0, i), c.slice(i + 1)];
});
const authPairs = pairs
  .filter(([k]) => /^sb-.+-auth-token(\.\d+)?$/.test(k))
  .sort(([a], [b]) => a.localeCompare(b));
const raw = authPairs.map(([, v]) => decodeURIComponent(v)).join("");
const session = JSON.parse(
  raw.startsWith("base64-") ? atob(raw.slice(7)) : raw,
);
console.log(session.access_token);

Pass the token as a header:

curl -X POST https://api.flowstep.ai/mcp \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

MCP sessions last 30 days — the server refreshes the underlying token transparently, so clients using the OAuth flow don’t need to re-authenticate during normal use. A manually extracted token like the one above still expires after about an hour; it’s for quick testing only.

Get Started

Using Flowstep

Teams & Organizations

Exporting & Integrations

MCP Server

Billing & Plans

Security & Privacy

MCP Authentication

OAuth 2.1 PKCE flow

Account creation for claude.ai connector users

Manual token (testing)

​OAuth 2.1 PKCE flow

​Supported login methods

​Account creation for claude.ai connector users

​Cookie fallback

​Manual token (testing)

OAuth 2.1 PKCE flow

Supported login methods

Account creation for claude.ai connector users

Cookie fallback

Manual token (testing)