---
title: "Authentication"
description: "Sign in to Heizen MCP with OAuth — what happens, and what you're approving."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.heizen.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

OAuth is the way people connect. You point your client at the endpoint, it
discovers the server's OAuth metadata, opens your browser, and you approve the
connection with the Studio account you already use. No token to copy, no
credential in a config file.

1. **Add the server to your client**

   See [Set up your client](/mcp/clients) for the exact command or config for
   your harness. All you're configuring is the URL.
2. **Log in**

   Adding the server doesn't authenticate it. Run the login command for your
   client — `claude mcp login heizen`, `codex mcp login heizen`, `/mcp auth
   heizen` — or click **Login** where the client lists the server.
3. **Approve in the browser**

   Your browser opens to Studio. Sign in if you aren't already, then approve the
   consent screen naming the client that asked.
4. **Back to work**

   The client stores the token and refreshes it on its own. Run `whoami` to
   confirm you're connected as the right account.

## What you're approving

An access token acts as **you**: it reaches every project you can reach in
Studio, with the same permissions your account has there. Someone who can't see
a project in Studio can't see it through MCP either.

| | |
|---|---|
| Grant | Authorization code + PKCE (S256 required) |
| Access token | 1 hour |
| Refresh token | 30 days, rotated on every use |
| Scope | a single `mcp` scope — granular scopes aren't available yet |
| Client registration | dynamic (RFC 7591), so any compliant client can connect |

Authorization codes are single-use and expire in 60 seconds; replaying one
revokes every token from that grant. Refresh tokens are hashed at rest. If you
sign out or the refresh window lapses, your client walks you through the same
browser approval again.

> **Self-hosted or staging?**
>
> Tokens are environment-specific. A token minted against staging won't resolve
> against production — sign in against the environment you're pointing at.

## When there's nobody to approve

CI jobs, scheduled agents and bots can't click a consent screen. They use a
project-scoped API key instead — see [API keys](/mcp/api-keys).

Source: https://docs.heizen.work/mcp/authentication/index.mdx