Enter a remote Model Context Protocol (MCP) server's URL on a new MCP connection, and Celigo reads the authentication settings the server publishes and pre-selects the authentication method. For vendors that accept Client ID Metadata Documents, you connect with a name, the URL, and a sign-in, with no OAuth 2.0 client (iClient), client ID, client secret, or scopes. For MCP servers that don't support automatic client registration, you can create an iClient with authentication details prefilled from the vendor's endpoints, when available. Enter the client ID and secret of an application you registered with the vendor.
Prerequisites: An absolute https URL for the MCP server.
How URL-first setup works
When you enter a valid https URL in MCP URI on a new MCP connection and stop typing for about a second, Celigo checks the server's published authentication settings. When the server publishes OAuth 2.0 settings, Configure authentication fills in:
- Auth type is set to OAuth 2.0.
- Client registration is set to Automatic when the server can support it, and to Pre-registered client otherwise.
-
Scope is prefilled with the scopes the server publishes.
If the check fails, the form shows no message and nothing is pre-selected. If the server publishes no OAuth 2.0 settings, Celigo selects OAuth 2.0 and Pre-registered client. You can change Auth type as needed.
The check runs only on a new connection and only while Configure authentication is empty. If you change the URL afterward, Automatic becomes available again, and Save & authorize checks the new server.
Choose between Automatic and Pre-registered client
Client registration decides how Celigo identifies itself to the server's authorization server. It appears under Auth type, OAuth 2.0 on MCP connections only.
| Automatic | Pre-registered client | |
|---|---|---|
| How Celigo identifies itself | With its Client ID Metadata Document on your region's integrator.io host. Its URL is the client ID. | With an iClient that holds the client ID and secret of your registered app. |
| What you enter | A name and the URL. | A name, the URL, and the app's client ID and secret. |
| Scopes | Automatically selected during authorization. There is no Scope field for Automatic. | Prefilled and editable. |
Use Automatic whenever the server supports it. Use Pre-registered client when the vendor requires an app registered in your own tenant, when you need to set scopes by hand, or when the vendor rejects Celigo's client.
Create the connection
- Go to Resources, and then select Connections.
-
Select + Create connection, and then select MCP from the application list.
- In General, enter a Name.
- In Application details, enter the server's URL in MCP URI, and wait for the check to finish. (Optional) Add any HTTP headers the server requires. See Create an MCP connection from an AI agent.
- Continue with the path that matches Client registration.
Connect with Automatic registration
- Confirm that Auth type is OAuth 2.0 and Client registration is Automatic.
-
Select Save & authorize. Celigo opens the vendor's sign-in in a new window. The consent screen names Celigo.
- Select Approve.
When Automatic isn't available
Automatic is disabled, with its reason shown when you point to or focus it, when the authorization server doesn't accept Client ID Metadata Documents, doesn't support Proof Key for Code Exchange (PKCE) with SHA-256, or publishes no OAuth 2.0 settings. Client registration moves to Pre-registered client with the discovered values prefilled. Continue with connect with a pre-registered client. A failed check doesn't disable Automatic, because a failure says nothing about the server.
Connect with a pre-registered client
Use this path when Client registration is Pre-registered client. To use your own app on a server that supports Automatic, select Pre-registered client first.
- In Configure OAuth 2.0, next to OAuth 2.0 client, select +. The Create iClient form opens with Grant type, Authorization URL, Access token URL, and Revoke token URL (when the server publishes one) already filled in.
- Enter a Name, Client ID, and Client secret. If Valid domain names or Send token via is empty, complete it. See Create an OAuth 2.0 iClient resource.
- Save the client, and then review Scope.
- Select Save & authorize, sign in to the vendor, and approve.
To use an iClient you already have, select it in OAuth 2.0 client instead. Celigo never changes an existing iClient, so confirm that its endpoints match this server.
Re-authorize a connection
When a vendor moves an endpoint or declines to refresh the connection's tokens, the connection goes offline. Open the connection and select Save & authorize. On Automatic, authorizing checks the server again and picks up the new endpoints. On Pre-registered client, update the iClient's URLs first if the vendor changed them.
Changing Client registration on a saved connection also requires authorizing again. The form says so under Client registration before you save.
Limits
- No Dynamic Client Registration. A vendor that offers only Dynamic Client Registration takes the Pre-registered client path with an app you register by hand.
- MCP connections only. Generic HTTP connections keep their existing OAuth 2.0 behavior.
- Existing connections are unchanged. An OAuth 2.0 MCP connection that uses an iClient shows Pre-registered client.
- The authorization server decides. A vendor can reject Celigo's client or grant fewer scopes than requested, and Celigo doesn't retry a different method on its own.
Troubleshoot authorization failures
Every authorization failure shows a status banner at the top of the form, headed "Your test was not successful. Check your information and try again", followed by the message for the failure and, when the vendor answered, "Vendor response: error — description". View log opens the API calls the failure made, beside the form. Before sign-in, it lists the request to the MCP server, the protected resource metadata request, and the authorization server metadata request. After sign-in, it lists the callback and the token exchange. For the general procedure, see Create a connection to an application.
| Message | Cause | Resolution |
|---|---|---|
| "This server's authorization server doesn't support automatic client registration. Switch to Pre-registered client and enter the client ID and secret from the app you registered with the vendor." | The server doesn't accept Client ID Metadata Documents, or your region's document isn't available. | Change Client registration to Pre-registered client. |
| "This server's authorization server doesn't support PKCE S256, which automatic client registration requires. Use a pre-registered client instead." | The server doesn't support PKCE with SHA-256. | Change Client registration to Pre-registered client. |
| "The authorization server rejected Celigo's client. Switch to Pre-registered client and enter the client ID and secret from the app you registered with the vendor." For example, "Vendor response: invalid_client — Client metadata document host is not in the trusted domain list" | The vendor rejected Celigo's client, usually under a domain trust policy. | Ask the vendor's administrator to allow Celigo, or change Client registration to Pre-registered client. |
| "The authorization server rejected the requested scopes. Switch to Pre-registered client to set the scopes manually." For example, "Vendor response: invalid_scope — The requested scope is invalid: read write" | The vendor refused the scopes Celigo selected, or refused an authorization with no scope. | Change Client registration to Pre-registered client and set Scope by hand. |
| "Celigo couldn't read authentication settings from this server. Check the URL, or configure authentication manually." | The server's metadata was unreachable, or the URL points at a private address. | Check that the URL is an absolute https URL for the MCP endpoint, or configure authentication manually. |
| "The server took too long to return its authentication settings. Try again, or configure authentication manually." | The check didn't finish in time. | Try again, or configure authentication manually. |
| "The server returned authentication settings that Celigo couldn't use. Check the URL, or configure authentication manually." | The metadata was malformed or didn't match the URL. | Check the URL against the vendor's documentation. |
| "Automatic client registration is currently turned off. Try again later." | Automatic registration is turned off for your region. No call was made, so there is no View log. | Try again later, or use Pre-registered client. |
| "Authorization could not be completed because no callback was received. Please try again." | You closed the vendor's window, or the vendor showed its own error page. There is no View log. | Select Save & authorize again. If the vendor reports a client or redirect URL error, its administrator may need to allow Celigo. |
| "Unable to retrieve the oAuth auth-code from query string." | You denied consent on the vendor's page. | Select Save & authorize again and approve. |
| "Unable to connect to the MCP server. Please check your connection settings and try again." with View log | Sign-in succeeded, but the connection test failed, for example because the path in the URL is wrong. The connection is saved and marked offline. | Fix the URL, and then test or authorize again. |
A tool call fails because the connection is missing permissions
When a server answers a call with 403 insufficient_scope, the call fails with an error that names the missing permissions and says to re-authorize the connection in integrator.io. Through a Celigo MCP server's proxy, the end user's AI client receives that message. The connection stays online.
- Open the connection and select Save & authorize.
- Approve the vendor's consent screen. Celigo requests the scopes it was granted before, plus the ones the server asked for.
If the authorization server keeps withholding the scopes, Celigo stops asking after a limited number of attempts. Change Client registration to Pre-registered client and add the named scopes to Scope.
The connection is offline
An offline MCP connection shows "This connection is currently offline. Re-enter your credentials to bring it back online." An Automatic connection has no credentials to re-enter, so select Save & authorize. A Pre-registered client connection may need the iClient's secret or URLs updated first. See Re-authorize a connection.