How IncidentFlow authenticates MCP clients and scopes every tool to a workspace.

Every IncidentFlow MCP tool call is authenticated and workspace‑scoped before it can read context or write workspace memory. Public documentation search is the only unauthenticated surface.

Authentication methods

Method	Credential	When to use
OAuth 2.1 (recommended)	Workspace‑scoped `RS256` access token	MCP connectors (ChatGPT, Claude, Codex) — set up automatically during connect.
Personal Access Token	`Authorization: Bearer <pat>`	Scripts and service accounts that manage their own token.

Send tokens in the Authorization header only — never as a query parameter. Tokens are always bound to a single workspace.

OAuth 2.1

IncidentFlow MCP is an OAuth 2.1 resource server — it validates access tokens but does not issue them. A connecting client:

reads /.well-known/oauth-protected-resource to locate the authorization server;
completes the authorization‑code + PKCE flow and consent;
receives a workspace‑scoped access token and calls tools with Authorization: Bearer <token>.

See Installation for the one‑command client setup and API for the token contract.

Scopes

Scope	Grants
`mcp:read`	Read/inspect tools and resources.
`mcp:tools:run`	Execute tools.

A request missing the required scope is rejected with 403 / PERMISSION_DENIED.

Workspace resolution

Tools never accept an arbitrary workspace. The platform resolves the active workspace from the authenticated principal, then applies permission checks before it calls any integration or memory service. A token issued for one workspace can never read another workspace's data.

Verify

Call incidentflow_auth_status to confirm the request carries a valid principal and workspace context, and incidentflow_capabilities to list the tools visible to your client.

Public documentation search

public_knowledge_search does not require workspace access. It searches only official documentation and never reads customer incidents, private URLs, tokens, or workspace memory. See Docs Search.

Authentication