Supported Authentication Techniques

The MCP endpoint is protected. Before you can access it—either from a browser or from an MCP client—you must authenticate using one of the supported techniques. This page describes the three options: API key, token-based, and OAuth 2.0 (manual). Choose the one that best fits how you plan to connect.

Important: Whichever technique you use, the resulting credential grants access to ArcGIS Enterprise resources on your behalf. Treat it like a password—do not share it publicly, embed it in client-side code, or commit it to source control.

API key based authentication

An API key is a long-lived credential you create once in your ArcGIS Enterprise organization and then reuse across sessions.

  1. Follow the Create an API key (ArcGIS Enterprise) tutorial to create API key credentials in your organization.

  2. Once you have generated the API key, supply it in one of two ways:

  3. From a browser, append it as a query parameter—for example, https://mcpbeta.webgistesting.net/server/platform/mcp?token=<your-api-key>.

  4. From an MCP client, pass it through the client's authentication mechanism. Each client exposes this differently—see the per-client steps in Connect from MCP Clients.

Token based authentication

A token is a short-lived credential generated from your ArcGIS Enterprise username and password. It is well suited to time-boxed testing because you control its expiration.

Important: This must be a Portal token. Generate it from your portal's sharing/rest/generateToken endpoint, and make sure the context in the URL (the Web Adaptor or context name) is the portal context—for example, /portal. A token generated from the ArcGIS Server admin API (the server's token endpoint) will not work.

Generate a token

  1. Open the portal's generate-token page at https://<domain name>/<portal Web Adaptor name or context name>/sharing/rest/generateToken—use the portal context (for example, portal), not the server context. For example: https://mcpbeta.webgistesting.net/portal/sharing/rest/generateToken.
  2. Enter the username and password for your enterprise organization.
  3. Enter the Web App URL.
  4. Choose an expiration appropriate for how long you plan to test.
  5. Submit the form to receive your token.

Supply the token

Once you have the token, supply it in one of two ways:

  • From a browser, append it as a query parameter—for example, https://mcpbeta.webgistesting.net/server/platform/mcp?token=<your-token>.
  • From an MCP client, pass it through the client's authentication mechanism. Each client exposes this differently—see the per-client steps in Connect from MCP Clients.

OAuth 2.0 (manual)

OAuth 2.0 lets a client obtain access on your behalf through an authorization flow rather than a static credential.

Follow the Create OAuth 2.0 credentials (ArcGIS Enterprise) steps to create OAuth 2.0 developer credentials. These give you a client ID, a redirect URI, and the authorization endpoint for your organization.

Important: manual configuration only

OAuth 2.0 support is manual. It works only with MCP clients that let you supply the authorization (OAuth) URL and credentials yourself. The MCP server does not advertise OAuth metadata for automatic discovery, so clients that rely on auto-discovering the authorization server will not detect it.

To connect, configure the client manually with the authorization endpoint URL, client ID, and redirect URI from your OAuth 2.0 developer credentials. If your client only supports auto-discovery and cannot accept a manually entered authorization URL, use API key or token-based authentication instead.

Once you understand the supported authentication techniques, continue to Get Started — Connect from the MCP Client to learn how to connect to the MCP catalog from MCP clients.