Skip to main content
PUT
Update MCP OAuth 2.1 Resource Server Configuration

Body

application/json

The request body resource

client_id
string

Statically pre-registered OAuth client ID at the IdP, for IdPs without RFC 7591 Dynamic Client Registration support (e.g. JumpCloud, Okta, Entra ID). When set, the gateway advertises itself as the authorization server and serves a Dynamic Client Registration shim that returns this client to MCP clients; tokens whose aud claim matches this client ID are accepted in addition to resource_uri.

Example:

"hoop-mcp"

client_secret
string

Optional client secret paired with client_id. Leave empty to use a public client with PKCE (recommended): the registration shim discloses this value to any registering MCP client.

Example:

""

enabled
boolean

Whether the /mcp endpoint accepts IdP-issued OAuth 2.1 JWTs in addition to Hoop-issued bearer tokens.

groups_claim
string

JWT claim name from which user groups are extracted. Defaults to "groups".

Example:

"groups"

resource_uri
string

Canonical resource URI used for RFC 8707 audience binding. Defaults to "<API_URL>/api/mcp" when empty. Compared against the aud claim of inbound JWTs in canonical URI form (host case, default port, and trailing slashes are ignored).

Example:

"https://use.hoop.dev/api/mcp"

Response

OK

client_id
string

Statically pre-registered OAuth client ID at the IdP, for IdPs without RFC 7591 Dynamic Client Registration support (e.g. JumpCloud, Okta, Entra ID). When set, the gateway advertises itself as the authorization server and serves a Dynamic Client Registration shim that returns this client to MCP clients; tokens whose aud claim matches this client ID are accepted in addition to resource_uri.

Example:

"hoop-mcp"

client_secret
string

Optional client secret paired with client_id. Leave empty to use a public client with PKCE (recommended): the registration shim discloses this value to any registering MCP client.

Example:

""

enabled
boolean

Whether the /mcp endpoint accepts IdP-issued OAuth 2.1 JWTs in addition to Hoop-issued bearer tokens.

groups_claim
string

JWT claim name from which user groups are extracted. Defaults to "groups".

Example:

"groups"

resource_uri
string

Canonical resource URI used for RFC 8707 audience binding. Defaults to "<API_URL>/api/mcp" when empty. Compared against the aud claim of inbound JWTs in canonical URI form (host case, default port, and trailing slashes are ignored).

Example:

"https://use.hoop.dev/api/mcp"