Update MCP OAuth 2.1 Resource Server Configuration
Enable, disable, or reconfigure the OAuth 2.1 Resource Server profile for the /mcp endpoint.
Body
The request body resource
Statically pre-registered OAuth client ID at the IdP, for IdPs without
RFC 7591 Dynamic Client Registration support (e.g. JumpCloud, Okta,
Entra ID). When set, the gateway advertises itself as the authorization
server and serves a Dynamic Client Registration shim that returns this
client to MCP clients; tokens whose aud claim matches this client ID
are accepted in addition to resource_uri.
"hoop-mcp"
Optional client secret paired with client_id. Leave empty to use a public client with PKCE (recommended): the registration shim discloses this value to any registering MCP client.
""
Whether the /mcp endpoint accepts IdP-issued OAuth 2.1 JWTs in addition to Hoop-issued bearer tokens.
JWT claim name from which user groups are extracted. Defaults to "groups".
"groups"
Canonical resource URI used for RFC 8707 audience binding. Defaults to
"<API_URL>/api/mcp" when empty. Compared against the aud claim of
inbound JWTs in canonical URI form (host case, default port, and
trailing slashes are ignored).
"https://use.hoop.dev/api/mcp"
Response
OK
Statically pre-registered OAuth client ID at the IdP, for IdPs without
RFC 7591 Dynamic Client Registration support (e.g. JumpCloud, Okta,
Entra ID). When set, the gateway advertises itself as the authorization
server and serves a Dynamic Client Registration shim that returns this
client to MCP clients; tokens whose aud claim matches this client ID
are accepted in addition to resource_uri.
"hoop-mcp"
Optional client secret paired with client_id. Leave empty to use a public client with PKCE (recommended): the registration shim discloses this value to any registering MCP client.
""
Whether the /mcp endpoint accepts IdP-issued OAuth 2.1 JWTs in addition to Hoop-issued bearer tokens.
JWT claim name from which user groups are extracted. Defaults to "groups".
"groups"
Canonical resource URI used for RFC 8707 audience binding. Defaults to
"<API_URL>/api/mcp" when empty. Compared against the aud claim of
inbound JWTs in canonical URI form (host case, default port, and
trailing slashes are ignored).
"https://use.hoop.dev/api/mcp"