The BoldDesk MCP Server supports two authentication methods:

  • OAuth 2.0
  • API Key authentication

Choose the method that best fits your needs.

OAuth 2.0 authentication

OAuth 2.0 is recommended for applications that require user authorization and secure, permission-based access. It provides:

  • User-authorized access with token-based authentication.
  • Scoped permissions for enhanced security.
  • Ideal for AI assistants, IDE extensions, and third-party applications.
  • User-specific access without exposing permanent credentials.

Setup: OAuth clients can be registered and managed in the BoldDesk Admin Portal under Settings > Developer Settings > MCP Configuration.

BoldDesk MCP follows the Dynamic Client Registration (DCR) approach, which allows OAuth clients to be registered programmatically without manual setup. This enables applications to request and obtain OAuth credentials dynamically at runtime, streamlining authentication for third-party integrations.

API key authentication

API keys are recommended for trusted server-side integrations and automation workflows. With this approach:

  • Each request to the MCP Server must include a valid BoldDesk API key.
  • The API key identifies the user and defines access permissions, such as brands, tickets, and actions.
  • All operations are performed using the permissions of the authenticated user.
  • Best for backend services, scheduled jobs, and internal automation workflows.

Choosing an authentication method

Method Use case Security level
OAuth 2.0 User-facing apps, copilots, IDE extensions High - token-based authentication, scoped permissions, user consent
API key Backend services, automation workflows, server-to-server integrations High - requires secure storage and rotation

Best practices:

  • Use OAuth 2.0 for user-facing and third-party integrations.
  • Use API keys only for trusted backend services.
  • Store credentials securely and never expose them in client-side applications.
  • Rotate API keys periodically according to your organization's security policies.
  • Regularly review connected OAuth clients in MCP Configuration.
  • Revoke access for unused integrations immediately.