Skip to main content

Configuring OAuth interactive authentication for the Docebo MCP server

  • Published on Oct 30, 2026
  • 3 minute(s) read
Prev Next

Introduction

Use OAuth interactive authentication to connect external AI assistants (for example, ChatGPT). Each end user signs in to Docebo and approves access once, which links their external AI assistant profile to their Docebo user account. The assistant then acts with that user's permissions.

For an overview of the available methods, see Docebo MCP server authentication and authorization.

This article is intended for Docebo Superadmins.

How it works

  1. A Superadmin creates an OAuth2 application in Docebo and uses its Client ID and Client Secret to set up the MCP client.

  2. Each user opens the Docebo connector in their external AI assistant, signs in to Docebo and approves access once.

  3. Docebo issues an access token for that user. The assistant sends it to the MCP server, and every tool runs with the permissions of that user.

Limitations

  • The current Docebo OAuth flow includes a scope check that could prevent non-superadmins from connecting the Docebo MCP Server to some MCP clients. However, following the step-by-step instructions provided in this article and in Setting up MCP clients for the Docebo MCP server ensures this limitation does not prevent usage with tested clients like ChatGPT, Claude, Microsoft Copilot Studio, Gemini Enterprise, and Slack. This limitation is expected to be resolved in future releases.

  • If your platform uses the Extended Enterprise app, users can authenticate through the Docebo MCP Server only when accessing an Extended Enterprise client configured with a secondary domain (or subdomain when using a custom domain for the main platform). Authentication is not currently supported for Extended Enterprise clients configured with a subfolder URL. This limitation is expected to be resolved in future releases.

Step 1: Create an OAuth2 application in Docebo

To allow secure communication between your external AI assistant and Docebo, a Superadmin must register the external AI assistant as an OAuth2 application within the platform.

Whenever the configuration steps ask you to enter https://[docebo-instance-name], use your platform's domain (e.g., https://yourcompany.docebosaas.com). If your platform uses a custom domain, you must enter your custom domain.

  1. Log into your Docebo platform as a Superadmin.

  2. Follow the instructions in the Activating and managing the API and SSO app article to create a new OAuth2 application.

  3. During setup, use the following configuration:

    • App Name: Docebo MCP Server

    • App Description: App to connect Docebo MCP Server

    • App Icon: optional

    • Client ID: Choose any unique Client ID (for example, docebo-mcp-server)

    • Client Secret: automatically generated

    • Redirect URI: the value depends on your MCP client. Use the values listed below for the most common clients. For other clients, refer to their documentation.

      • ChatGPT: the Redirect URI is generated when you set up the connector in ChatGPT. Enter a temporary placeholder for now and return to update this field once ChatGPT provides the URI.

      • Claude: https://claude.ai/api/mcp/auth_callback

      • Microsoft Copilot Studio: the Redirect URI is generated when you set up the connector in Copilot Studio. Enter a temporary placeholder for now and return to update this field once Copilot Studio provides the URI.

      • Gemini Enterprise: https://vertexaisearch.cloud.google.com/oauth-redirect

      • Slack: https://oauth2.slack.com/external/auth/callback

    • Advanced settings: keep the defaults, with grant types set to Authorization code + implicit grant.

The OAuth2 application name, description, and icon are displayed to end users when they authorize the connection between their external AI assistant and Docebo. Choose values that are recognizable within your organization and clearly identify the purpose of the integration.

Once the application is created, safely store the Client ID and Client Secret. You will need these values when you set up your MCP client.

Multiple external AI assistants configuration

If you want to connect the same Docebo MCP server to multiple external AI assistants (for example, ChatGPT and Claude), create a separate OAuth2 application for each assistant. Each application must have its own Client ID and redirect URI, while all of them can point to the same Docebo MCP server configured in Configuring Docebo MCP servers. Set up each external AI assistant using the corresponding OAuth2 application.

Step 2: Set up your MCP client

The administrator of your external AI assistant connects the Docebo MCP server using the MCP server URL and the Client ID and Client Secret from Step 1. See Setting up MCP clients for the Docebo MCP server. If your client generates the Redirect URI, return to the OAuth2 application, enter it in the Redirect URI field and save.

Step 3: Authorize access (end-user authentication)

Once the administrator configuration is complete, the integration is ready for end users. Upon first use, users must add the Docebo connector from the list of enterprise connectors made available by their MCP client administrators. After selecting the Docebo connector, they will click the authorization link to initiate the OAuth flow, securely linking their external AI assistant profile to their Docebo user account.

Related articles