Introduction
The Docebo MCP server uses the same OAuth2 authentication and user permissions as the rest of the Docebo platform. Each tool runs with the permissions of the Docebo user the token represents, so the MCP server never gives access beyond what that user already has in Docebo.
This article is intended for Docebo Superadmins who need to choose how an MCP client authenticates with Docebo.
Supported authentication methods
The Docebo MCP server supports two authentication methods. Both use Docebo's standard OAuth 2.0 endpoints and produce the same kind of access token. They differ only in how the token is requested.
Method | How it works | The token represents | Typical use | Setup |
|---|---|---|---|---|
OAuth interactive | The user signs in and approves access once, in a browser | The user who approved | External AI assistants (for example, ChatGPT) | |
OAuth system-to-system | Your backend signs a JWT with its private key and exchanges it for an access token at the Docebo OAuth token endpoint | The Docebo user named in the | Backend services, agents and scheduled jobs that you build |
Choosing the right method
Use OAuth interactive authentication when:
You need to connect an external AI assistant (for example, ChatGPT).
A person is present and should approve access with their own Docebo account.
Use OAuth system-to-system authentication when:
You need non-interactive, machine-to-machine authentication.
No person is present: a backend service, an agent or a scheduled job calls the MCP server.
Permissions
A tool succeeds only if the user represented by the token is allowed to perform that action in Docebo. For example, a learner token cannot run administrator tools: the call returns an error.
The tools a server exposes are chosen by the Superadmin in the MCP Configurator. See Configuring Docebo MCP servers.