> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowstep.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Authentication

> How Flowstep MCP authenticates clients: OAuth 2.1 PKCE flow and account creation.

The `/mcp` endpoint requires a Supabase `access_token` passed as a Bearer token. Most MCP clients obtain this automatically via the OAuth 2.1 PKCE flow. You can also supply a token manually for testing.

## OAuth 2.1 PKCE flow

Flowstep implements a full OAuth 2.1 authorization server at `https://api.flowstep.ai`. MCP clients discover and complete the flow automatically: they open a browser window for you to log in, then handle the token exchange behind the scenes.

### Supported login methods

The authorization page at `/oauth/authorize` supports:

* **Email/password** — any Flowstep account with a password set
* **Google SSO** — redirects through Supabase social auth, returns to the client automatically

### Account creation for claude.ai connector users

The OAuth login page does not include a sign-up form. If you're connecting via claude.ai's custom connector and don't have a Flowstep account yet, create one first at [app.flowstep.ai](https://app.flowstep.ai), then return to the connector setup to authenticate.

## Cookie fallback

If no `Authorization` header is present, the middleware falls back to a cookie-based Supabase session. This works when accessing `/mcp` directly from a browser with an active Flowstep session. MCP clients always use the Bearer path.

## Manual token (testing)

To call the endpoint directly without a client OAuth flow:

1. Sign in to [app.flowstep.ai](https://app.flowstep.ai) in your browser
2. Open DevTools → Console, run:

```javascript theme={"system"}
const pairs = document.cookie.split("; ").map((c) => {
  const i = c.indexOf("=");
  return [c.slice(0, i), c.slice(i + 1)];
});
const authPairs = pairs
  .filter(([k]) => /^sb-.+-auth-token(\.\d+)?$/.test(k))
  .sort(([a], [b]) => a.localeCompare(b));
const raw = authPairs.map(([, v]) => decodeURIComponent(v)).join("");
const session = JSON.parse(
  raw.startsWith("base64-") ? atob(raw.slice(7)) : raw,
);
console.log(session.access_token);
```

3. Pass the token as a header:

```bash theme={"system"}
curl -X POST https://api.flowstep.ai/mcp \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

<Warning>
  MCP sessions last 30 days — the server refreshes the underlying token transparently, so clients using the OAuth flow don't need to re-authenticate during normal use. A manually extracted token like the one above still expires after about an hour; it's for quick testing only.
</Warning>