Managing security profiles

A security profile defines the identity and authorization vocabulary that an API-facing capability can use. MCP servers bind to one security profile, and can assign only the scopes and claims defined by that profile.

Create a profile

1. Open Settings > Organization > Security Profiles.
2. Select New Security Profile.
3. Enter a unique Name and choose the Provider Type.
4. Enter the provider's Discovery URL and expected Audience.
5. Add allowed scopes and optional descriptions.
6. Add the claims that policies or tools may require.
7. Save the profile and test it with a non-production client before broad use.

Design guidance

• Use an issuer-controlled HTTPS discovery URL.
• Set a specific audience; do not accept tokens minted for unrelated services.
• Name scopes by resource and action, such as orders:read and orders:write.
• Define only claims that are stable, necessary, and available in issued tokens.
• Separate profiles when applications have materially different issuers or trust requirements.
• Review dependent MCP servers before editing or deleting a profile.

warning

A valid token is not automatically authorized. The issuer, audience, signature, expiry, scopes, and required claims must all satisfy the profile and operation policy.

For server-level assignment and OAuth applications, see MCP servers.