{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"MCP Servers","description":"Okta Developer API Reference","siteUrl":"https://developer.okta.com","keywords":"okta, api reference docs","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"mcp-servers","__idx":0},"children":["MCP Servers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Model Context Protocol (MCP) servers are external resource servers that provide AI-powered capabilities and tools to workload principals (AI agents). MCP servers can be integrated with Okta to enable secure, authorized access to their capabilities through standardized OAuth 2.0 flows."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta for AI Agents manages the registration, configuration, and lifecycle of third-party MCP servers, helping to ensure the following:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["MCP servers are properly validated before allowing connections"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authorization servers that are protecting MCP Servers are configured correctly for token exchange"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Readiness checks verify all dependencies are satisfied"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access is authorized through standard OAuth 2.0 protocols"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"architecture","__idx":2},"children":["Architecture"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"mcp-server-components","__idx":3},"children":["MCP Server Components"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"graph TB\n MCP[MCP Server]\n AS[Authorization Servers]\n WP[Workload Principal]\n\n MCP --> AS\n WP --> AS\n WP -.requests tokens.-> AS\n AS -.issues tokens.-> WP\n WP -.authorized requests.-> MCP\n\n style MCP fill:#e1f5ff\n style AS fill:#fff4e1\n style WP fill:#f0e1ff\n","diagramHtml":"

requests tokens

issues tokens

authorized requests

MCP Server

Authorization Servers

Workload Principal

","diagramHtmlDark":"

requests tokens

issues tokens

authorized requests

MCP Server

Authorization Servers

Workload Principal

"},"children":["graph TB\n MCP[MCP Server]\n AS[Authorization Servers]\n WP[Workload Principal]\n\n MCP --> AS\n WP --> AS\n WP -.requests tokens.-> AS\n AS -.issues tokens.-> WP\n WP -.authorized requests.-> MCP\n\n style MCP fill:#e1f5ff\n style AS fill:#fff4e1\n style WP fill:#f0e1ff\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"authorization-server-types","__idx":4},"children":["Authorization Server Types"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["MCP servers can be associated with two types of authorization servers:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Okta Custom Authorization Servers"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["aus..."]}," prefix). See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/customas"},"children":["Custom Authorization Servers"]},"."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Support XAA (Cross-App Access) capability"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Okta custom authorization servers with ID-JAG token support"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["No additional protocol configuration required"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External Authorization Servers"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["eas..."]}," prefix)"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Support STS (Security Token Service) capability"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["External identity providers (such as GitHub and GitLab)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Require OAuth endpoint configuration"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Require client registration in Okta"]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"capabilities","__idx":5},"children":["Capabilities"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["MCP servers support different authorization capabilities:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["XAA (Cross-App Access)"]},": Native identity chaining for token exchange"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["STS (Security Token Service)"]},": Standard OAuth 2.0 token exchange with external IdPs"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An MCP server is considered connectable when at least one authorization server supports either XAA or STS capabilities."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"lifecycles","__idx":6},"children":["Lifecycles"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"mcp-server-lifecycle","__idx":7},"children":["MCP Server Lifecycle"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["MCP servers transition through different states during their lifecycle:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"stateDiagram-v2\n [*] --> PENDING: Create Server\n\n PENDING --> INACTIVE: Admin Registers\n PENDING --> INVALID: Validation Fails\n PENDING --> DELETED: Delete Before Registration\n\n INACTIVE --> ACTIVE: Activate Server\n INACTIVE --> INVALID: Validation Fails\n INACTIVE --> DELETED: Delete Server\n\n ACTIVE --> INACTIVE: Deactivate Server\n ACTIVE --> INVALID: Runtime Validation Fails\n\n INVALID --> INACTIVE: Fix Issues & Validate\n INVALID --> DELETED: Delete Server\n\n DELETED --> [*]\n","diagramHtml":"

Create Server

Admin Registers

Validation Fails

Delete Before Registration

Activate Server

Validation Fails

Delete Server

Deactivate Server

Runtime Validation Fails

Fix Issues & Validate

Delete Server

PENDING

INACTIVE

INVALID

DELETED

ACTIVE

","diagramHtmlDark":"

Create Server

Admin Registers

Validation Fails

Delete Before Registration

Activate Server

Validation Fails

Delete Server

Deactivate Server

Runtime Validation Fails

Fix Issues & Validate

Delete Server

PENDING

INACTIVE

INVALID

DELETED

ACTIVE

"},"children":["stateDiagram-v2\n [*] --> PENDING: Create Server\n\n PENDING --> INACTIVE: Admin Registers\n PENDING --> INVALID: Validation Fails\n PENDING --> DELETED: Delete Before Registration\n\n INACTIVE --> ACTIVE: Activate Server\n INACTIVE --> INVALID: Validation Fails\n INACTIVE --> DELETED: Delete Server\n\n ACTIVE --> INACTIVE: Deactivate Server\n ACTIVE --> INVALID: Runtime Validation Fails\n\n INVALID --> INACTIVE: Fix Issues & Validate\n INVALID --> DELETED: Delete Server\n\n DELETED --> [*]\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"mcp-server-status-descriptions","__idx":8},"children":["MCP Server Status Descriptions"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PENDING"]},": MCP server created but not yet ready for operations. Initial state after creation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["INACTIVE"]},": MCP server is inactive and ready to be activated. Configuration has been validated."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ACTIVE"]},": MCP server is active and operational. Can accept connections from clients."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["INVALID"]},": MCP server configuration is invalid or validation failed. Requires remediation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DELETED"]},": MCP server has been deleted and removed from the system."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"mcp-server-state-transitions","__idx":9},"children":["MCP Server State Transitions"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"from-pending","__idx":10},"children":["From PENDING"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Registers"]}," → INACTIVE: Admin completes registration and configuration"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Validation Fails"]}," → INVALID: Server configuration fails validation checks"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete Before Registration"]}," → DELETED: Server is deleted before completing registration"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"from-inactive","__idx":11},"children":["From INACTIVE"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Activate Server"]}," → ACTIVE: Admin activates the server for use"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Validation Fails"]}," → INVALID: Subsequent validation reveals configuration issues"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete Server"]}," → DELETED: Server is deleted before activation"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"from-active","__idx":12},"children":["From ACTIVE"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Deactivate Server"]}," → INACTIVE: Admin deactivates the server"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Runtime Validation Fails"]}," → INVALID: Runtime checks detect configuration problems"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"from-invalid","__idx":13},"children":["From INVALID"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Fix Issues & Validate"]}," → INACTIVE: Issues are resolved and validation passes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete Server"]}," → DELETED: Server is deleted instead of being fixed"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"authorization-server-lifecycle","__idx":14},"children":["Authorization Server Lifecycle"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authorization servers associated with MCP servers follow a similar lifecycle with connectivity verification:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"stateDiagram-v2\n [*] --> PENDING: Create Server\n\n PENDING --> INACTIVE: Register Server\n PENDING --> INVALID: Validation Fails\n PENDING --> DELETED: Delete Before Registration\n\n INACTIVE --> ACTIVE: Activate & Verify Connectivity\n INACTIVE --> INVALID: Validation Fails\n INACTIVE --> DELETED: Delete Server\n\n ACTIVE --> INACTIVE: Deactivate Server\n ACTIVE --> INVALID: Configuration Issues\n\n INVALID --> INACTIVE: Fix Issues & Validate\n INVALID --> DELETED: Delete Server\n\n DELETED --> [*]\n","diagramHtml":"

Create Server

Register Server

Validation Fails

Delete Before Registration

Activate & Verify Connectivity

Validation Fails

Delete Server

Deactivate Server

Configuration Issues

Fix Issues & Validate

Delete Server

PENDING

INACTIVE

INVALID

DELETED

ACTIVE

","diagramHtmlDark":"

Create Server

Register Server

Validation Fails

Delete Before Registration

Activate & Verify Connectivity

Validation Fails

Delete Server

Deactivate Server

Configuration Issues

Fix Issues & Validate

Delete Server

PENDING

INACTIVE

INVALID

DELETED

ACTIVE

"},"children":["stateDiagram-v2\n [*] --> PENDING: Create Server\n\n PENDING --> INACTIVE: Register Server\n PENDING --> INVALID: Validation Fails\n PENDING --> DELETED: Delete Before Registration\n\n INACTIVE --> ACTIVE: Activate & Verify Connectivity\n INACTIVE --> INVALID: Validation Fails\n INACTIVE --> DELETED: Delete Server\n\n ACTIVE --> INACTIVE: Deactivate Server\n ACTIVE --> INVALID: Configuration Issues\n\n INVALID --> INACTIVE: Fix Issues & Validate\n INVALID --> DELETED: Delete Server\n\n DELETED --> [*]\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-concepts","__idx":15},"children":["Related Concepts"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"workload-principals","__idx":16},"children":["Workload Principals"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Workload principals (AI agents) request tokens from authorization servers to access MCP server capabilities. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/secures-ai/openapi/secures-ai-workload-principals/tags/agentregistration"},"children":["Workload Principals"]}," for more information."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"token-exchange","__idx":17},"children":["Token Exchange"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["MCP servers use OAuth 2.0 token exchange flows:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID-JAG tokens"]},": Issued by Okta org authorization servers for XAA capability"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access tokens"]},": Exchanged or issued for accessing MCP server resources"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.okta.com/docs/guides/ai-agent-token-exchange/authserver/main/"},"children":["AI agent token exchange guide - Authorization server (ID-JAG)"]}," for detailed flow documentation."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"protocol-configuration","__idx":18},"children":["Protocol Configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["External authorization servers (STS capability) require configuration of:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization endpoint"]},": OAuth 2.0 authorization endpoint URL"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token endpoint"]},": OAuth 2.0 token endpoint URL"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Grant types"]},": Supported OAuth grant types (authorization_code, refresh_token)"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.okta.com/docs/guides/ai-agent-token-exchange/resourceserver/main/"},"children":["AI agent token exchange guide - Resource server"]}," for detailed flow documentation."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"client-registration","__idx":19},"children":["Client Registration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["External authorization servers require the MCP server to be registered as a trusted client in Okta. This registration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Creates an OAuth client app in Okta"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Configures client credentials for token exchange"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Establishes trust between Okta and the external authorization server"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/secures-ai/openapi/secures-ai-resource-servers/tags/mcpserverregistration"},"children":["MCP Server Registration"]}," API reference and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://help.okta.com/okta_help.htm?type=oie&id=ai-agent-mcp-server"},"children":["Add MCP servers"]}," in the help documentation."]}]},"headings":[{"value":"MCP Servers","id":"mcp-servers","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Architecture","id":"architecture","depth":2},{"value":"MCP Server Components","id":"mcp-server-components","depth":3},{"value":"Authorization Server Types","id":"authorization-server-types","depth":3},{"value":"Capabilities","id":"capabilities","depth":3},{"value":"Lifecycles","id":"lifecycles","depth":2},{"value":"MCP Server Lifecycle","id":"mcp-server-lifecycle","depth":3},{"value":"MCP Server Status Descriptions","id":"mcp-server-status-descriptions","depth":4},{"value":"MCP Server State Transitions","id":"mcp-server-state-transitions","depth":4},{"value":"From PENDING","id":"from-pending","depth":5},{"value":"From INACTIVE","id":"from-inactive","depth":5},{"value":"From ACTIVE","id":"from-active","depth":5},{"value":"From INVALID","id":"from-invalid","depth":5},{"value":"Authorization Server Lifecycle","id":"authorization-server-lifecycle","depth":3},{"value":"Related Concepts","id":"related-concepts","depth":2},{"value":"Workload Principals","id":"workload-principals","depth":3},{"value":"Token Exchange","id":"token-exchange","depth":3},{"value":"Protocol Configuration","id":"protocol-configuration","depth":3},{"value":"Client Registration","id":"client-registration","depth":3}],"frontmatter":{"title":"MCP Servers","meta":[{"name":"description","content":"Learn about Model Context Protocol (MCP) server management in Okta for AI Agents"}],"seo":{"title":"MCP Servers"}},"lastModified":"2026-05-22T16:22:36.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/secures-ai/mcp-servers","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}