--- title: "Configuring OAuth system-to-system authentication for the Docebo MCP server" slug: "configuring-oauth-system-to-system-authentication-for-the-docebo-mcp-server" updated: 2026-10-30T13:10:03Z published: 2026-10-30T13:10:03Z canonical: "developer.docebo.com/configuring-oauth-system-to-system-authentication-for-the-docebo-mcp-server" --- > ## Documentation Index > Fetch the complete documentation index at: https://developer.docebo.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring OAuth system-to-system authentication for the Docebo MCP server ## Introduction Use system-to-system authentication when a backend service, custom agent, or scheduled job needs to call the Docebo MCP server without a person signing in. For an overview of the available authentication methods, see [Docebo MCP server authentication and authorization](/v1/docs/docebo-mcp-server-authentication-and-authorization). Your service uses the OAuth 2.0 JWT Bearer grant to obtain a Docebo access token. The access token represents a specific Docebo user, and every MCP tool runs with that user's existing permissions. For detailed information about the JWT Bearer grant, see *Using the JWT Bearer grant type* in the [APIs authentication](/v1/docs/apis-authentication#using-the-jwt-bearer-grant-type) article. This article is intended for Docebo Superadmins. ## How it works 1. A Superadmin creates an OAuth2 application in Docebo, enables the JWT Bearer grant, and uploads the public key for the integration. 2. Your backend service creates and signs a JWT with its private key. The JWT identifies the OAuth2 application and the Docebo user whose permissions the service will use. 3. Your service sends the signed JWT to the Docebo OAuth token endpoint and receives a Docebo access token. 4. Your service sends the access token with every request to an enabled Docebo MCP server. Each tool runs with the permissions of the Docebo user identified in the JWT. Before configuring the integration, activate the API and SSO app in your Docebo platform, identify the Docebo user whose permissions the integration will use, and create an enabled MCP server with the required tools. ## Step 1: Create an OAuth2 application in Docebo Create an OAuth2 application to identify your integration and store the public key used to verify its JWTs. 1. Log into your Docebo platform as a Superadmin. 2. Follow the instructions in the [Activating and managing the API and SSO app](/v1/docs/activating-and-managing-the-api-and-sso-app) article to create a new OAuth2 application. 3. During setup, use the following configuration: - **App Name:** Docebo MCP Server (system-to-system) - **App Description:** App to connect Docebo MCP Server - **Client ID:** Enter a unique identifier. Your service uses this value as the `iss` claim when it creates a JWT. - **Client Secret:** Docebo generates this value automatically. It is not used by the JWT Bearer grant. - **Redirect URI:** This flow does not use browser redirection, but the field requires a value. Enter your platform domain, for example, `https://yourcompany.docebosaas.com`. 4. Select **Show advanced settings**. 5. Under **Grant types**, select *JWT bearer*. 6. In the *JWT bearer* section, select **Upload public key** and upload the public key that corresponds to the private key your service will use to sign JWTs. 7. Select **Confirm**. Note the **Client ID**. Your service needs it when generating JWTs. ## Step 2: Generate and sign a JWT Your service must generate a JWT and sign it with the private key corresponding to the public key uploaded in the OAuth2 application. Use the `RS256` signature algorithm and include the claims required for the JWT Bearer grant. For this integration: - Set `iss` to the Client ID of the OAuth2 application created in Step 1. - Set `sub` to the username of the Docebo user whose permissions the integration must use. - Set `aud` to the hostname of your Docebo platform, without the protocol. For example, `yourcompany.docebosaas.com`. - Set `iat` to the time the JWT was created, as a Unix timestamp. - Set `exp` to the time the JWT expires, as a Unix timestamp. The value of the `sub` claim determines the permissions available to the integration. For example, an integration that uses a learner's username cannot run administrator tools. ## Step 3: Exchange the JWT for an access token Send the signed JWT to the Docebo OAuth token endpoint: ```plaintext https://[docebo-instance-name]/oauth2/token ``` Use the JWT Bearer grant type and the `api` scope. The token endpoint returns an access token. This is the token that your service must send when calling the Docebo MCP server. ## Step 4: Call the MCP server Copy the URL of the enabled MCP server from the MCP Configurator. Your service must send the access token in the `Authorization` header on every request to the MCP server: ```plaintext Authorization: Bearer ``` The implementation depends on the MCP client or SDK used by your service. Configure it to retrieve a new Docebo access token when needed and include that token in the `Authorization` header. ## Step 5: Renew the access token Access tokens expire. Before the token expires, generate and sign a new JWT, then repeat Step 3 to obtain a new access token. Your service must use the new access token for subsequent MCP requests.