Skip to content

docs: clarify that setting OAUTH_ISSUER enables OAuth #188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AryanBagade wants to merge 3 commits into
base: main
Choose a base branch
from
+18 −9
Open

docs: clarify that setting OAUTH_ISSUER enables OAuth #188

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cd4029f
docs: clarify that setting OAUTH_ISSUER enables OAuth
AryanBagade Dec 22, 2025
e1caaa2
Merge branch 'tableau:main' into docs/clarify-oauth-issuer-enables-oauth
AryanBagade Jan 17, 2026
74ee260
docs: change 'URL' to 'origin' for OAUTH_ISSUER description
AryanBagade Jan 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/docs/configuration/mcp-config/authentication/oauth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,10 @@ is accessed using a local development URL e.g. `http://127.0.0.1:3927/tableau-mc
When `AUTH` is `oauth`, the MCP server will use a Tableau session initiated by the Tableau OAuth
flow to authenticate to the Tableau REST APIs.

OAuth is enabled by setting the `OAUTH_ISSUER` environment variable to the URL of your MCP server.

:::info

See [Enabling OAuth](../oauth.md) for details on how to configure the MCP server to use OAuth.
See [Enabling OAuth](../oauth.md) for full details on configuring OAuth.

:::
23 changes: 15 additions & 8 deletions docs/docs/configuration/mcp-config/oauth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,23 @@ is accessed using a local development URL e.g. `http://127.0.0.1:3927/tableau-mc

:::

When a URL for `OAUTH_ISSUER` is provided, the MCP server will act as an OAuth 2.1 resource server,
capable of accepting and responding to protected resource requests using encrypted access tokens.
When enabled, MCP clients will first require logging in via Tableau OAuth to connect to the MCP
server. For more information, please see the
## How to Enable OAuth

To enable OAuth, set the [`OAUTH_ISSUER`](#oauth_issuer) environment variable to the URL of your MCP server. When a URL for `OAUTH_ISSUER` is provided, the MCP server will act as an OAuth 2.1 resource server, capable of accepting and responding to protected resource requests using encrypted access tokens.

When OAuth is enabled:
- MCP clients will be required to authenticate via Tableau OAuth before connecting to the MCP server
- The [`TRANSPORT`](#transport) will default to `http` (required for OAuth)
- The [`AUTH`](#auth) method will default to `oauth`

For more information, please see the
[MCP Authorization spec](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization).

<hr />

## Environment Variables

When OAuth is enabled, the following environment variables also apply or have additional meaning:
The following environment variables configure OAuth behavior:

### `AUTH`

Expand All @@ -40,11 +46,12 @@ The method the MCP server uses to authenticate to the Tableau REST APIs.

### `OAUTH_ISSUER`

The issuer of the OAuth server. This should be the host of the MCP server.
**Setting this environment variable enables OAuth.** This should be the URL of your MCP server (the issuer of access tokens).

- Required if `AUTH` is `oauth`. For testing, use `http://127.0.0.1:3927`.
- Example: `http://127.0.0.1:3927` (for local testing) or `https://tableau-mcp.example.com` (for production)
- Required if `AUTH` is `oauth`
- Required if `TRANSPORT` is `http` unless opted out with
[`DANGEROUSLY_DISABLE_OAUTH`](#dangerously_disable_oauth).
[`DANGEROUSLY_DISABLE_OAUTH`](#dangerously_disable_oauth)

<hr />

Expand Down
Loading