connect-with-oidc

For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

<!-- Tab options on this page. Append to the .md URL to filter: ?tabs=<id,...> select specific tabs (e.g. ?tabs=nodejs,shell) ?allTabs=true include every tab (no param) default: one tab per tabset

Available tabs: other tabs: auth-code-flow, device-auth-flow -->

Connect with OpenID Connect (OIDC)

You can connect to a MongoDB Enterprise deployment or MongoDB Atlas cluster using OpenID Connect (OIDC) authentication with the MongoDB MCP Server.

To learn more, see Authentication and Authorization with OIDC/OAuth 2.0.

Configuration Options

To connect to a MongoDB deployment with OIDC, configure the following options in your [MCP server configuration:](https://www.mongodb.com/docs/mcp-server/local-mcp/configuration.md#std-label-mcp-server-configuration

CLI Option Name OS Environment Variable Name Type Necessity Description
authenticationMechanism MDB_MCP_AUTHENTICATION_MECHANISM string Required Set to MONGODB-OIDC to use OIDC authentication.
oidcFlows MDB_MCP_OIDC_FLOWS array of strings Optional Specifies OIDC flows in a comma-separated list. The OIDC flows specify how the MongoDB MCP Server interacts with the identity provider for the authentication process. The MongoDB MCP Server supports the following OIDC flows: auth-code, device-auth.
oidcRedirectUri MDB_MCP_OIDC_REDIRECT_URI string Optional Specifies a URI where the identity provider redirects you after authentication. The URI must match the configuration of the identity provider. Default: http://localhost:27097/redirect.
browser MDB_MCP_BROWSER string Optional Specifies the browser the MongoDB MCP Server redirects you to when MONGODB-OIDC is enabled.
oidcIdTokenAsAccessToken MDB_MCP_OIDC_ID_TOKEN_AS_ACCESS_TOKEN boolean Optional Specifies whether the MongoDB MCP Server uses the ID token received from the identity provider instead of the access token. Use this option with identity providers that you can't configure to provide JWT access tokens.
oidcTrustedEndpoint MDB_MCP_OIDC_TRUSTED_ENDPOINT string Optional Specifies a connection to a trusted endpoint that is not Atlas or localhost to ensure that access tokens are sent to trusted servers. Only use this option when connecting to servers that you trust.

OIDC Flows

The MongoDB MCP Server supports two OIDC flows:

  • Authorization Code Flow (default)

  • Device Authorization Grant Flow (when browser-based authentication isn't available)

Note:

When you configure the MongoDB MCP Server to accept remote connections, it uses Device Authorization Grant Flow.

Authorization Code Flow

The Authorization Code Flow is the default OIDC mechanism. In this flow, the user authenticates with the identity provider (IdP) in a browser and the MCP server exchanges the authorization code for tokens.

  • If you start the server with a MongoDB connection string, the server completes browser-based authentication on startup.

  • If you use the MCP server's connect tool, authentication runs interactively. While authentication is in progress, operations that require a database connection are unavailable. If sign-in does not complete promptly, the attempt times out and you can try again. You can view your MCP server logs for details.