MCP Authentication

The Verbatik MCP server supports two authentication methods.

1. API Key Authentication

The simplest method. Use your Verbatik API key as a Bearer token:

Authorization: Bearer vbt_your_api_key

This is the recommended approach for most integrations. Get your API key from the API Keys section in your workspace sidebar.

2. OAuth 2.1 Authentication

For MCP clients that support OAuth, Verbatik implements a full OAuth 2.1 flow:

• Dynamic Client Registration — MCP clients register themselves automatically.
• PKCE (Proof Key for Code Exchange) — Required for security. Supports the S256 method.
• Authorization Code Flow — Standard OAuth authorization with user consent.
• Refresh Token Rotation — Tokens are automatically refreshed.

OAuth Endpoints

Token Lifetimes

Discovery Endpoints

OAuth Flow Steps

1. Discovery — The MCP client fetches OAuth metadata from the well-known endpoints.
2. Registration — The client registers itself via the registration endpoint.
3. Authorization — The user is redirected to Verbatik's authorization page.
4. Workspace Selection — The user selects which workspace to authorize.
5. Code Exchange — The client receives an authorization code and exchanges it for tokens (with PKCE verification).
6. API Access — The client uses the access token for MCP requests.
7. Token Refresh — When the access token expires, the client uses the refresh token to get a new one.