Your own MCP servers

A workspace owner can register an MCP server of their own. Authlane discovers its tool contract and offers the server to that organization's users exactly like a built-in integration: each user authorizes it under their own account, and your runtime calls the server directly with a leased credential. Authlane never relays a tool call.

Prerequisites

A server reachable over HTTPS from the public internet that speaks MCP and either implements OAuth 2.1 authorization server metadata or accepts a per-user API key.

Register the server

In the dashboard, open MCP Servers, give the server a name, paste its URL and choose how users authorize it.

Registration runs discovery immediately. The server stays unavailable until a discovery succeeds, so a URL nobody can reach is never offered to your users. A failure is shown on the card with the reason; fix the server and press Rediscover.

Discovery refuses a URL that resolves to a private address, and every OAuth endpoint has to sit on the same registrable domain as the URL you registered. The endpoints are stored at discovery and never re-read when a user connects, so a server cannot present one endpoint while you are looking and another one afterwards.

Judge the tools

Discovery records every tool as write, whatever the server declares about itself. A third party labelling a destructive tool read-only would otherwise walk straight through a read_only connection, so what the server claims is shown next to your decision rather than used as it.

Open Tools on the server card to lower a tool to read once you have checked what it does, raise it to destructive, or switch a tool off entirely. Your judgement survives every later rediscovery.

Connect a user

Nothing changes in your application code. The server appears in the catalog under its generated id, which starts with mcp-:

export async function connectMcpServer(userId: string) {
  // The generated id is shown on the server card in the dashboard.
  return authlane.connectSessions.create({
    externalUserId: userId,
    allowedServices: ['mcp-2f1c4a90-0f1e-4a3b-9d2e-7c5b1a08d4f6'],
    allowedOrigin: 'https://app.example.com',
  });
}

For a server that uses per-user API keys, the widget collects the key from the user instead of redirecting; the key is encrypted at rest like any other credential.

Expected result

tools.list returns the approved tools alongside the built-in ones, and a credential lease carries access material only — never a refresh or ID token.

Remove a server

Removing a server deletes every user's connection to it in the same step. There is no undo.