Authentication

Madgicx MCP uses OAuth 2.0 with PKCE (Proof Key for Code Exchange) for secure authentication. This ensures your Madgicx account credentials are never shared with AI clients.

Security Features

PKCE (Proof Key for Code Exchange)

PKCE protects against authorization code interception attacks:

1. Client generates a random code_verifier
2. Client sends a hash (code_challenge) with the authorization request
3. During token exchange, client proves possession of the original code_verifier

Token Security

Team Isolation

Each authorization is scoped to a single Madgicx team:

• Tokens are valid only for the selected team
• Switching teams requires re-authorization
• Team admins can revoke access at any time

Token Refresh

Access tokens expire after 1 hour. The refresh process is automatic:

1. AI client detects expired token
2. Client uses refresh token to request new access token
3. MCP server validates and issues new tokens
4. Tool calls continue without user intervention

Revoking Access

To revoke MCP access:

1. From AI Client: Disconnect the MCP connector
2. Automatic: After 30 days of inactivity

Next Steps

• OAuth Flow - Detailed flow documentation