diff --git a/docs/docs/configuration/mcp-config/authentication/oauth.md b/docs/docs/configuration/mcp-config/authentication/oauth.md index 3281a656..936b7a61 100644 --- a/docs/docs/configuration/mcp-config/authentication/oauth.md +++ b/docs/docs/configuration/mcp-config/authentication/oauth.md @@ -15,8 +15,10 @@ is accessed using a local development URL e.g. `http://127.0.0.1:3927/tableau-mc When `AUTH` is `oauth`, the MCP server will use a Tableau session initiated by the Tableau OAuth flow to authenticate to the Tableau REST APIs. +OAuth is enabled by setting the `OAUTH_ISSUER` environment variable to the origin of your MCP server. + :::info -See [Enabling OAuth](../oauth.md) for details on how to configure the MCP server to use OAuth. +See [Enabling OAuth](../oauth.md) for full details on configuring OAuth. ::: diff --git a/docs/docs/configuration/mcp-config/oauth.md b/docs/docs/configuration/mcp-config/oauth.md index 4c4c7be1..7abe33f5 100644 --- a/docs/docs/configuration/mcp-config/oauth.md +++ b/docs/docs/configuration/mcp-config/oauth.md @@ -12,17 +12,23 @@ is accessed using a local development URL e.g. `http://127.0.0.1:3927/tableau-mc ::: -When a URL for `OAUTH_ISSUER` is provided, the MCP server will act as an OAuth 2.1 resource server, -capable of accepting and responding to protected resource requests using encrypted access tokens. -When enabled, MCP clients will first require logging in via Tableau OAuth to connect to the MCP -server. For more information, please see the +## How to Enable OAuth + +To enable OAuth, set the [`OAUTH_ISSUER`](#oauth_issuer) environment variable to the origin of your MCP server. When a URL for `OAUTH_ISSUER` is provided, the MCP server will act as an OAuth 2.1 resource server, capable of accepting and responding to protected resource requests using encrypted access tokens. + +When OAuth is enabled: +- MCP clients will be required to authenticate via Tableau OAuth before connecting to the MCP server +- The [`TRANSPORT`](#transport) will default to `http` (required for OAuth) +- The [`AUTH`](#auth) method will default to `oauth` + +For more information, please see the [MCP Authorization spec](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization).
## Environment Variables -When OAuth is enabled, the following environment variables also apply or have additional meaning: +The following environment variables configure OAuth behavior: ### `AUTH` @@ -40,11 +46,12 @@ The method the MCP server uses to authenticate to the Tableau REST APIs. ### `OAUTH_ISSUER` -The issuer of the OAuth server. This should be the host of the MCP server. +**Setting this environment variable enables OAuth.** This should be the origin of your MCP server (the issuer of access tokens). -- Required if `AUTH` is `oauth`. For testing, use `http://127.0.0.1:3927`. +- Example: `http://127.0.0.1:3927` (for local testing) or `https://tableau-mcp.example.com` (for production) +- Required if `AUTH` is `oauth` - Required if `TRANSPORT` is `http` unless opted out with - [`DANGEROUSLY_DISABLE_OAUTH`](#dangerously_disable_oauth). + [`DANGEROUSLY_DISABLE_OAUTH`](#dangerously_disable_oauth)