Configuring OAuth system-to-system authentication for the Docebo MCP server

  • Published on Oct 30, 2026
  • 3 minute(s) read
Prev Next

Introduction

Use system-to-system authentication when a backend service, custom agent, or scheduled job needs to call the Docebo MCP server without a person signing in.

For an overview of the available authentication methods, see Docebo MCP server authentication and authorization.

Your service uses the OAuth 2.0 JWT Bearer grant to obtain a Docebo access token. The access token represents a specific Docebo user, and every MCP tool runs with that user's existing permissions.

For detailed information about the JWT Bearer grant, see Using the JWT Bearer grant type in the APIs authentication article.

This article is intended for Docebo Superadmins.

How it works

  1. A Superadmin creates an OAuth2 application in Docebo, enables the JWT Bearer grant, and uploads the public key for the integration.

  2. Your backend service creates and signs a JWT with its private key. The JWT identifies the OAuth2 application and the Docebo user whose permissions the service will use.

  3. Your service sends the signed JWT to the Docebo OAuth token endpoint and receives a Docebo access token.

  4. Your service sends the access token with every request to an enabled Docebo MCP server. Each tool runs with the permissions of the Docebo user identified in the JWT.

Before configuring the integration, activate the API and SSO app in your Docebo platform, identify the Docebo user whose permissions the integration will use, and create an enabled MCP server with the required tools.

Step 1: Create an OAuth2 application in Docebo

Create an OAuth2 application to identify your integration and store the public key used to verify its JWTs.

  1. Log into your Docebo platform as a Superadmin.

  2. Follow the instructions in the Activating and managing the API and SSO app article to create a new OAuth2 application.

  3. During setup, use the following configuration:

    • App Name: Docebo MCP Server (system-to-system)

    • App Description: App to connect Docebo MCP Server

    • Client ID: Enter a unique identifier. Your service uses this value as the iss claim when it creates a JWT.

    • Client Secret: Docebo generates this value automatically. It is not used by the JWT Bearer grant.

    • Redirect URI: This flow does not use browser redirection, but the field requires a value. Enter your platform domain, for example, https://yourcompany.docebosaas.com.

  4. Select Show advanced settings.

  5. Under Grant types, select JWT bearer.

  6. In the JWT bearer section, select Upload public key and upload the public key that corresponds to the private key your service will use to sign JWTs.

  7. Select Confirm.

Note the Client ID. Your service needs it when generating JWTs.

Step 2: Generate and sign a JWT

Your service must generate a JWT and sign it with the private key corresponding to the public key uploaded in the OAuth2 application.

Use the RS256 signature algorithm and include the claims required for the JWT Bearer grant.

For this integration:

  • Set iss to the Client ID of the OAuth2 application created in Step 1.

  • Set sub to the username of the Docebo user whose permissions the integration must use.

  • Set aud to the hostname of your Docebo platform, without the protocol. For example, yourcompany.docebosaas.com.

  • Set iat to the time the JWT was created, as a Unix timestamp.

  • Set exp to the time the JWT expires, as a Unix timestamp.

The value of the sub claim determines the permissions available to the integration. For example, an integration that uses a learner's username cannot run administrator tools.

Step 3: Exchange the JWT for an access token

Send the signed JWT to the Docebo OAuth token endpoint:

https://[docebo-instance-name]/oauth2/token

Use the JWT Bearer grant type and the api scope.

The token endpoint returns an access token. This is the token that your service must send when calling the Docebo MCP server.

Step 4: Call the MCP server

Copy the URL of the enabled MCP server from the MCP Configurator.

Your service must send the access token in the Authorization header on every request to the MCP server:

Authorization: Bearer <access_token>

The implementation depends on the MCP client or SDK used by your service. Configure it to retrieve a new Docebo access token when needed and include that token in the Authorization header.

Step 5: Renew the access token

Access tokens expire. Before the token expires, generate and sign a new JWT, then repeat Step 3 to obtain a new access token.

Your service must use the new access token for subsequent MCP requests.

Related articles