AuthPI MCP is AuthPI’s own protected resource at https://mcp.authpi.com/mcp. It uses AuthPI’s sign-in issuer and permissions. You do not configure an exchange client in your customer issuer to connect to it.

Building your own MCP server with your own issuer? Follow Let your MCP server call your API for a user. That issuer-scoped capability is separate from this hosted integration.

Connect

1. Add https://mcp.authpi.com/mcp as a remote server in an MCP application that supports streamable HTTP and OAuth. Use the exact /mcp URL.
2. Let the application discover the server’s authorization metadata and complete AuthPI sign-in and consent. The consumer needs a registered OAuth client or support for issuer-enabled Client ID Metadata Documents (CIMD); AuthPI does not provide Dynamic Client Registration (RFC 7591).
3. Call whoami to verify the connection.

The application obtains an access token for the MCP resource through authorization code with PKCE. You do not paste an AuthPI organization API key or your customer issuer’s token into this connection. The resource advertises the issuer to use through its protected-resource metadata.

What works today

The current tool surface contains one read-only tool, whoami. It returns the verified user and OAuth client, granted OAuth scopes, and organization membership claims. When the token has a selected organization, it also returns selected_organization_id; otherwise the tool does not choose an organization for you.

Use this response to check that you signed in as the expected user. Memberships are a snapshot carried in the token, not a live permission lookup. The tool does not list or provision AuthPI resources, and it does not call the Core API.

Delegation to AuthPI Core

The issuer supports the token-exchange protocol, but the MCP adapter and Core-backed tools are not yet part of the current integration. There is no customer-side exchange-client setup that enables those missing tools.

For that integration, AuthPI operates the service client and its secret. The MCP resource is https://mcp.authpi.com/mcp; the Core resource is https://api.authpi.com. The human remains the subject of the delegated token, and the service is its actor.

Core trusts AuthPI’s own configured issuer. An exchange policy in your issuer does not make its output a valid AuthPI Core credential, even if you set the target resource to the Core URL. Customer issuers can issue delegated tokens for APIs that explicitly trust them.

Core requires a delegated profile for its canonical resource audience. The existing AuthPI Console retains a separate legacy-audience compatibility path; that exception does not extend trust to customer issuers. For ordinary backend automation that manages AuthPI resources, use an organization API key.