--- title: "Preset MCP Server Authentication" slug: "preset-mcp-server-authentication" updated: 2026-09-08T19:08:19Z published: 2026-09-08T19:08:19Z canonical: "docs.preset.io/preset-mcp-server-authentication" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.preset.io/llms.txt > Use this file to discover all available pages before exploring further. # Preset MCP Server Authentication This feature is available as an add-on to Enterprise plans. If you have a Starter or Professional subscription, [contact us to upgrade](https://preset.io/contact-sales/). ## Overview The Preset MCP (Model Context Protocol) server allows AI assistants like Claude and ChatGPT to interact with your Preset workspace — listing dashboards, querying datasets, executing SQL, and more. This guide covers the different ways to authenticate with the Preset MCP server. Choose the method that best fits your use case. --- ## Prerequisites Before you begin, make sure you have the following: - A Preset account with access to a workspace - Your Preset workspace MCP URL: `https://<workspace-slug>.<region>.app.preset.io/mcp` | **Auth Method** | **AI Client** | **Plan Requirements** | | --- | --- | --- | | OAuth | Claude (Web, Desktop, Code) | Free (1 connector), Pro, Max, Team, or Enterprise | | OAuth | ChatGPT | Plus, Pro, Business, Enterprise, or Edu | | OAuth | Gemini CLI | Free | | OAuth (confidential client) | Gemini Enterprise | Team Admin access in Preset Manager to generate client credentials | | JWT / Bearer | Any (programmatic) | Preset API credentials (Token Name + Secret) | --- ## Method 1: OAuth (Recommended) OAuth is the simplest method — the AI client handles authentication automatically by getting an OAuth token from your Preset Cloud session. **No tokens to manage or refresh.** **SSO support**: If your company domain is configured with SSO, the OAuth flow will route through your identity provider automatically. You'll authenticate with your SSO credentials just as you would when logging into Preset directly. Your MCP identity is matched to your Preset account by email. ### Claude Web ([claude.ai](http://claude.ai)) & Claude Desktop #### Steps 1. Open [claude.ai](http://claude.ai) in your browser 2. Expand the sidebar and navigate to **Customize** 3. Click on **Connectors** 4. Click on the **+** icon next to the magnifying glass > **Add custom connector** 5. Fill in the details: - **Name**: A descriptive name (e.g., `My Preset Workspace`) - **URL**: Your workspace MCP URL (e.g., `https://<workspace-slug>.<region>.app.preset.io/mcp`) 6. Click **Add** 7. You'll be redirected to Preset Cloud to obtain an OAuth token. If you're already logged in to Preset, you'll be redirected back to Claude automatically. **Notes:** - Custom connectors are available on Free (1 connector), Pro, Max, Team, and Enterprise plans - Once connected, the Preset tools will be available in your conversations - For Team/Enterprise plans, only **Owners** can add connectors, but all users can then enable them **Reference**: [Getting Started with Custom Connectors Using Remote MCP](https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) --- ### Claude Code (Terminal) Claude Code is Anthropic's terminal-based coding assistant. It supports OAuth for MCP servers via the CLI. #### Steps **Step 1: Add the MCP server (one time)** ``` claude mcp add --transport http preset-mcp https://..app.preset.io/mcp ``` **Step 2: Launch Claude Code** ``` claude ``` **Step 3: Trigger the OAuth flow** Once inside the Claude Code session, run: ``` /mcp ``` This will open a browser window where you can authenticate with Preset. After logging in, the connection will be established and Preset tools will be available in your session. **Notes:** - The `--transport http` flag is required to enable OAuth for remote MCP servers - Your credentials are stored securely in your system keychain (macOS) or a credentials file — not in your config - If the browser redirect fails, Claude Code will prompt you to paste the callback URL from your browser's address bar manually - If your session token expires mid-conversation, re-run `/mcp` to re-authenticate without leaving your session --- ### ChatGPT Web #### Step 1: Enable Developer Mode (if needed) 1. Click on your profile icon at the top left of the ChatGPT page 2. Select **Settings** 3. Go to **Apps and Connectors** 4. Scroll down and select **Advanced Settings** 5. Enable **Developer Mode** #### Step 2: Add the MCP Server 1. Press the **+** button in the chat composer 2. Click **Add sources** 3. Go to **App** -> **Connect more** 4. Click **Create app** 5. Fill in the details: - **Name**: A descriptive name (e.g., `My Preset Workspace`) - **MCP server URL**: Your workspace MCP URL 6. Press **I understand and continue** 7. Authenticate with Preset when prompted via OAuth **Using the Connector** Once connected, the Preset tools should be visible in the composer's **Use Connectors** menu. You can then ask ChatGPT to list dashboards, query datasets, execute SQL, explore metadata, and more! **Reference**: [Connect from ChatGPT](https://developers.openai.com/apps-sdk/deploy/connect-chatgpt/) --- ### Gemini CLI (Terminal) Gemini CLI is Google's open-source terminal-based AI agent. It supports remote MCP servers with automatic OAuth discovery — no token management required. #### Prerequisites - [Gemini CLI](https://github.com/google-gemini/gemini-cli) installed #### Steps **Step 1: Add the MCP server configuration** Add your Preset workspace to `~/.gemini/settings.json`: ``` { "mcpServers": { "preset": { "url": "https://..app.preset.io/mcp" } } } ``` Replace `<workspace-slug>` and `<region>` with the values from your Preset workspace URL. **Step 2: Launch Gemini CLI and authenticate** Start Gemini CLI: ``` gemini ``` Then authenticate with the Preset MCP server: ``` /mcp auth preset ``` A browser window will open for OAuth authentication. Log in with your Preset credentials. You should see: ``` ℹ ✅ Successfully authenticated with MCP server 'preset'! ℹ Restarting MCP server 'preset'... ℹ Successfully authenticated and reloaded tools for 'preset' ``` **Step 3: Verify the connection** Try a command like "List my dashboards" or "What datasets are available?" **Notes:** - The OAuth token is cached in `~/.gemini/mcp-oauth-tokens.json` for subsequent sessions - If your token expires or you encounter a stale session, delete the cached token and re-authenticate: ``` rm ~/.gemini/mcp-oauth-tokens.json gemini ``` #### Multiple Workspaces To connect to multiple Preset workspaces, add entries with unique names: ``` { "mcpServers": { "preset-production": { "url": "https://..app.preset.io/mcp" }, "preset-staging": { "url": "https://..app.preset.io/mcp" } } } ``` **Reference**: [Gemini CLI MCP Server Documentation](https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md) ### Gemini Enterprise Gemini Enterprise connects to the Preset MCP server as a **Custom MCP Server data store**. Unlike Gemini CLI, it does not use OAuth auto-discovery or dynamic client registration, so instead of registering itself it requires a confidential OAuth client — a Client ID and Client Secret that you generate in Preset Manager. **Preset supports discovery; Gemini Enterprise does not use it.** The Preset MCP server publishes standard OAuth metadata and supports dynamic client registration. The manual client below is needed because of how Gemini Enterprise connects, not because of a limitation in Preset. #### Prerequisites - MCP enabled for the workspace (**Edit Workspace** -> **AI and MCP** -> **Enable MCP for this workspace**) - Team Admin access to Preset Manager, in order to generate OAuth client credentials - Permission in Google Cloud to create a Custom MCP Server data store #### Step 1: Generate OAuth client credentials in Preset 1. In Preset Manager, open the workspace's **⋮** menu and select **Edit Workspace** 2. Go to the **AI and MCP** tab and expand **MCP OAuth Clients** 3. Enter a **Client name**, for example `Gemini Enterprise` 4. In **Redirect URIs**, enter Gemini Enterprise's fixed callback address and click **ADD URI**: ``` https://vertexaisearch.cloud.google.com/oauth-redirect ``` 5. Click **GENERATE CREDENTIALS** 6. Copy both the **Client ID** and the **Client Secret**, then click **I have the values saved** The redirect URI must be added with the **ADD URI** button *before* you generate credentials — the interface will warn you that the URI is not saved yet. The **Client Secret is displayed only once** and cannot be retrieved afterwards, so copy it before dismissing the panel. **Allow about a minute.** After the client is created, the workspace picks up the new credentials within roughly one minute. If your first authorization attempt in Gemini Enterprise fails, wait briefly and retry before changing any settings. #### Step 2: Collect the connection URLs The same **MCP OAuth Clients** panel displays the three URLs Gemini Enterprise requires. They follow this pattern: ``` MCP Base URL: https://..app.preset.io/mcp Authorization URL: https://..app.preset.io/mcp/authorize Token URL: https://..app.preset.io/mcp/token ``` #### Step 3: Configure the data store in Gemini Enterprise Create a Custom MCP Server data store and complete the OAuth 2.0 configuration with the following values: | **Gemini Enterprise field** | **Value** | | --- | --- | | MCP Server URL | The MCP Base URL from Step 2 | | Authorization URL | The Authorization URL from Step 2 | | Token URL | The Token URL from Step 2 | | Client ID | From Step 1 | | Client Secret | From Step 1 | | Scopes | `openid email profile offline_access` | | Enable PKCE Support | Enabled — the Preset MCP server supports `S256` | Include the `offline_access` scope. Without it, Gemini Enterprise cannot refresh its access token — the connection will work initially and then fail once the first token expires. Authenticate with your Preset credentials when prompted. All MCP operations respect your existing Preset roles and permissions. #### Managing existing clients Generated clients are listed at the bottom of the **MCP OAuth Clients** panel, showing the client name, Client ID, the last four characters of the secret, and the creation date. Each entry offers: - **Rotate** — issues a new Client Secret while keeping the same Client ID - **Revoke** — deletes the client Revoking a client stops new sign-ins once the workspace refreshes its configuration, typically in under a minute. Tokens that have already been issued may remain valid for up to 24 hours. #### Tool discovery in Gemini Enterprise The Preset MCP server's `tools/list` response advertises four top-level operations — `call_tool`, `search_tools`, `get_instance_info` and `health_check`. Individual operations such as `query_dataset`, `list_datasets` and `get_dashboard_info` are reached by dispatching through `call_tool` rather than being declared separately. Gemini Enterprise builds its Actions list directly from `tools/list`, so the Actions tab shows those four entries. Clients that support runtime tool discovery can locate an operation with `search_tools` and then invoke it with `call_tool`. Clients that require every action to be declared at registration time cannot currently surface the individual Preset operations. Because Gemini Enterprise only sees the generic `call_tool` operation, it treats every call as potentially data-modifying and prompts for user confirmation each time, including for read-only operations. **Reference**: [Set up a Custom MCP Server data store](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/set-up-custom-mcp-server) --- ## Method 2: Authentication via API Token This method generates a JWT by exchanging your Preset API credentials (token name + secret) for a short-lived access token. Ideal for **CLI-based setups** and **automation**. Note: When authenticating via JWT or Bearer token, the AI client operates with the same API permissions as the authenticated user account. This means the assistant may be able to perform actions beyond the explicitly listed MCP tools — including any API endpoint your account has access to. ### Step 1: Generate API Credentials in Preset Manager 1. Log in to your Preset workspace 2. Navigate to **Settings** -> **API Keys** (or your team's API key management page) 3. Click **Create API Key** (or equivalent) 4. You will receive two values: | **Value** | **Description** | | --- | --- | | **API Token Name** | A UUID identifier for the token | | **API Token Secret** | A secret value — **save this securely; it is only shown once** | ### Step 2: Exchange Credentials for a JWT Use the [Preset Auth API](https://api-docs.preset.io/#cdf2f4d7-1842-4a3e-bd15-a747295704ee) to exchange your API token name and secret for a JWT access token. **Auth URL:** `https://api.app.preset.io/v1/auth/` **Example curl request:** ``` curl --location 'https://api.app.preset.io/v1/auth/' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --data '{ "name": "YOUR_API_TOKEN_NAME", "secret": "YOUR_API_TOKEN_SECRET" }' ``` **Example response:** ``` { "payload": { "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." } } ``` Extract the `access_token` value from the response — this is your JWT. ### Step 3: Use the JWT with MCP Once you have a JWT, include it in the `Authorization` header when making requests to the MCP server: ``` curl -X POST 'https://..app.preset.io/mcp' \ --header 'Authorization: Bearer YOUR_JWT_TOKEN' \ --header 'Content-Type: application/json' \ --data '{"jsonrpc": "2.0", "method": "tools/list", "id": 1}' ``` - Claude Desktop JSON config with JWT For Claude Desktop with JSON config, you can use `mcp-remote` with the bearer token: ``` { "mcpServers": { "preset-workspace": { "command": "npx", "args": [ "-y", "mcp-remote@latest", "https://..app.preset.io/mcp", "--header", "Authorization: Bearer YOUR_JWT_TOKEN" ] } } } ``` **Note:** JWT tokens expire. You will need to refresh them periodically by repeating Step 2. --- ## Troubleshooting ### Connection Issues **Can't connect to the MCP server?** - Ensure you're using `https://` in the URL (not `http://`) - Verify your Preset workspace is accessible - Check that you have the required subscription plan for your AI client ### Authentication Issues **Authentication failing?** - **OAuth**: Clear your browser cookies and try re-authenticating - **JWT**: Verify your API token and secret are correct. Tokens expire — re-generate if needed - **Gemini Enterprise**: Newly generated credentials take about a minute to become active — wait and retry before changing settings. Confirm the Scopes field includes `offline_access`, and that the redirect URI `https://vertexaisearch.cloud.google.com/oauth-redirect` was added with **ADD URI** before the client was generated ### Server Not Appearing in AI Client - **Claude Desktop**: Completely quit and restart the application after config changes - **Claude Web / ChatGPT**: Refresh the page and check your connectors list - **Gemini Enterprise**: Use **Reload custom actions** on the data store's Actions tab. Four operations (`call_tool`, `search_tools`, `get_instance_info`, `health_check`) is the expected result — see [Tool discovery in Gemini Enterprise](/docs/preset-mcp-server-authentication#tool-discovery-in-gemini-enterprise) - Verify the MCP URL format is correct: `https://<workspace-slug>.<region>.app.preset.io/mcp` ### Common Errors | **Error** | **Cause** | **Fix** | | --- | --- | --- | | **401 Unauthorized** | Token is invalid or expired | Re-generate a JWT or re-authenticate via OAuth | | **403 Forbidden** | Insufficient permissions or MCP not enabled | Check workspace access and MCP feature status | | **Connection Refused** | Wrong URL or inactive workspace | Verify workspace URL and that workspace is active | --- ## Security Notes **Keep your credentials safe.** - The MCP connection allows the AI assistant to access your Preset data based on your user permissions and role - Store API credentials securely — never share your API Token Secret - JWT tokens should be treated as sensitive credentials - OAuth client secrets for Gemini Enterprise are shown only once. If a secret is exposed, use **Rotate** to issue a new one or **Revoke** to delete the client — note that already-issued tokens may remain valid for up to 24 hours ---