> Markdown version of https://authpi.com/docs/guides/authpi-mcp/ — fetch the complete AuthPI docs index at https://authpi.com/llms.txt to discover all available pages.

# Use AuthPI MCP

Connect to AuthPI's hosted MCP resource, verify your identity with whoami, and understand the current tool surface.

AuthPI MCP is AuthPI's own protected resource at `https://mcp.authpi.com/mcp`. It uses AuthPI's sign-in issuer and permissions. You do not configure an exchange client in your customer issuer to connect to it.

Building your own MCP server with your own issuer? Follow [Let your MCP server call your API for a user](/docs/guides/mcp-token-exchange/). That issuer-scoped capability is separate from this hosted integration.

## Connect

1. Add `https://mcp.authpi.com/mcp` as a remote server in an MCP application that supports streamable HTTP and OAuth. Use the exact `/mcp` URL.
2. Let the application discover the server's authorization metadata and complete AuthPI sign-in and consent. The consumer needs a registered OAuth client or support for issuer-enabled Client ID Metadata Documents (CIMD); AuthPI does not provide Dynamic Client Registration (RFC 7591).
3. Call `whoami` to verify the connection.

The application obtains an access token for the MCP resource through authorization code with PKCE. You do not paste an AuthPI organization API key or your customer issuer's token into this connection. The resource advertises the issuer to use through its protected-resource metadata.

## What works today

The current tool surface contains one read-only tool, `whoami`. It returns the verified user and OAuth client, granted OAuth scopes, and organization membership claims. When the token has a selected organization, it also returns `selected_organization_id`; otherwise the tool does not choose an organization for you.

Use this response to check that you signed in as the expected user. Memberships are a snapshot carried in the token, not a live permission lookup. The tool does not list or provision AuthPI resources, and it does not call the Core API.

## Delegation to AuthPI Core

The issuer supports the [token-exchange protocol](/docs/reference/oidc/#token-exchange-grant-rfc-8693-constrained-profile), but the MCP adapter and Core-backed tools are not yet part of the current integration. There is no customer-side exchange-client setup that enables those missing tools.

For that integration, AuthPI operates the service client and its secret. The MCP resource is `https://mcp.authpi.com/mcp`; the Core resource is `https://api.authpi.com`. The human remains the subject of the delegated token, and the service is its actor.

Core trusts AuthPI's own configured issuer. An exchange policy in **your** issuer does not make its output a valid AuthPI Core credential, even if you set the target resource to the Core URL. Customer issuers can issue delegated tokens for APIs that explicitly trust them.

Core requires a delegated profile for its canonical resource audience. The existing AuthPI Console retains a separate legacy-audience compatibility path; that exception does not extend trust to customer issuers. For ordinary backend automation that manages AuthPI resources, use an [organization API key](/docs/guides/api-keys/).