---
title: "Docebo MCP server authentication and authorization"
slug: "docebo-mcp-server-authentication-and-authorization"
updated: 2026-10-30T13:09:03Z
published: 2026-10-30T13:09:03Z
canonical: "developer.docebo.com/docebo-mcp-server-authentication-and-authorization"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://developer.docebo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Docebo MCP server authentication and authorization

## Introduction

The Docebo MCP server uses the same OAuth2 authentication and user permissions as the rest of the Docebo platform. Each tool runs with the permissions of the Docebo user the token represents, so the MCP server never gives access beyond what that user already has in Docebo.

This article is intended for Docebo Superadmins who need to choose how an MCP client authenticates with Docebo.

## Supported authentication methods

The Docebo MCP server supports two authentication methods. Both use Docebo's standard OAuth 2.0 endpoints and produce the same kind of access token. They differ only in how the token is requested.

| Method | How it works | The token represents | Typical use | Setup |
| --- | --- | --- | --- | --- |
| OAuth interactive | The user signs in and approves access once, in a browser | The user who approved | External AI assistants (for example, ChatGPT) | [Configuring OAuth interactive authentication](/v1/docs/configuring-oauth-interactive-authentication-for-the-docebo-mcp-server) |
| OAuth system-to-system | Your backend signs a JWT with its private key and exchanges it for an access token at the Docebo OAuth token endpoint | The Docebo user named in the `sub` claim of the JWT | Backend services, agents and scheduled jobs that you build | [Configuring OAuth system-to-system authentication](/v1/docs/configuring-oauth-system-to-system-authentication-for-the-docebo-mcp-server) |

## Choosing the right method

Use OAuth interactive authentication when:

- You need to connect an external AI assistant (for example, ChatGPT).
- A person is present and should approve access with their own Docebo account.

Use OAuth system-to-system authentication when:

- You need non-interactive, machine-to-machine authentication.
- No person is present: a backend service, an agent or a scheduled job calls the MCP server.

## Permissions

- A tool succeeds only if the user represented by the token is allowed to perform that action in Docebo. For example, a learner token cannot run administrator tools: the call returns an error.
- The tools a server exposes are chosen by the Superadmin in the MCP Configurator. See [Configuring Docebo MCP servers](/v1/docs/configuring-docebo-mcp-servers).