> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-muhammad-kumail-native-mcp-tabs-batch.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Update Credentials > UpdateCredentials replaces the auth config and/or config fields for an MCP server. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/mcp_servers/{connector_id}/credentials openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/mcp_servers/{connector_id}/credentials: post: tags: - MCP Servers summary: Update Credentials description: >- UpdateCredentials replaces the auth config and/or config fields for an MCP server. operationId: c1.api.ai_governance.v1.MCPServerService.UpdateCredentials parameters: - in: path name: app_id required: true schema: description: App identifier. type: string - in: path name: connector_id required: true schema: description: MCP server identifier (connector ID). type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerServiceUpdateCredentialsRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerServiceUpdateCredentialsResponse description: >- MCPServerServiceUpdateCredentialsResponse returns the updated MCP server. x-codeSamples: - lang: go label: UpdateCredentials source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.MCPServer.UpdateCredentials(ctx, operations.C1APIAiGovernanceV1MCPServerServiceUpdateCredentialsRequest{\n AppID: \"\",\n ConnectorID: \"\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.MCPServerServiceUpdateCredentialsResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.ai_governance.v1.MCPServerServiceUpdateCredentialsRequestInput: description: >- MCPServerServiceUpdateCredentialsRequest updates the auth credentials and config fields for an existing MCP server. Secrets are sealed before storage. properties: externalConfig: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerExternalConfig - type: 'null' hostedConfig: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerHostedConfig - type: 'null' updateMask: type: - string - 'null' title: Mcp Server Service Update Credentials Request type: object x-speakeasy-name-override: MCPServerServiceUpdateCredentialsRequest c1.api.ai_governance.v1.MCPServerServiceUpdateCredentialsResponse: description: >- MCPServerServiceUpdateCredentialsResponse returns the updated MCP server. properties: mcpServer: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerView' - type: 'null' title: Mcp Server Service Update Credentials Response type: object x-speakeasy-name-override: MCPServerServiceUpdateCredentialsResponse c1.api.ai_governance.v1.MCPServerExternalConfig: description: > MCPServerExternalConfig configures an external MCP server accessed via HTTP transport. The server is routed through the MCP gateway for credential decryption. This message contains a oneof named auth_config. Only a single field of the following list may be set at a time: - none - bearerToken - oauth2 - customHeader - basicAuth properties: basicAuth: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthBasicAuth - type: 'null' bearerToken: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthBearerToken - type: 'null' customHeader: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthCustomHeader - type: 'null' none: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerAuthNone' - type: 'null' oauth2: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerAuthOAuth2' - type: 'null' requireToolApproval: description: |- Optional per-server override for tool auto-approval. See MCPServerView.require_tool_approval for semantics. enum: - OPTIONAL_BOOL_UNSPECIFIED - OPTIONAL_BOOL_TRUE - OPTIONAL_BOOL_FALSE type: string x-speakeasy-unknown-values: allow tokenSharing: description: >- Token sharing model. SHARED = admin authorizes once; PER_USER = each user authenticates independently. PER_USER is supported for OAuth2 authorization_code, bearer_token, custom_header, and basic_auth. Defaults to SHARED at runtime. enum: - MCP_SERVER_TOKEN_SHARING_UNSPECIFIED - MCP_SERVER_TOKEN_SHARING_SHARED - MCP_SERVER_TOKEN_SHARING_PER_USER type: string x-speakeasy-unknown-values: allow transportType: description: Transport type for the MCP connection. enum: - MCP_SERVER_TRANSPORT_TYPE_UNSPECIFIED - MCP_SERVER_TRANSPORT_TYPE_STREAMABLE_HTTP - MCP_SERVER_TRANSPORT_TYPE_SSE type: string x-speakeasy-unknown-values: allow url: description: The HTTP endpoint URL of the external MCP server (HTTPS required). type: string title: Mcp Server External Config type: object x-speakeasy-name-override: MCPServerExternalConfig c1.api.ai_governance.v1.MCPServerHostedConfig: description: > MCPServerHostedConfig configures a hosted MCP server backed by the MCP gateway. This message contains a oneof named auth_config. Only a single field of the following list may be set at a time: - none - bearerToken - oauth2 - customHeader - googleServiceAccount - awsSigv4 - basicAuth properties: awsSigv4: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthAWSSigV4 - type: 'null' basicAuth: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthBasicAuth - type: 'null' bearerToken: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthBearerToken - type: 'null' configFields: additionalProperties: type: string description: |- Extra config field values keyed by catalog config field name. Sent as plaintext over TLS; the backend seals secret fields based on catalog schema. type: object customHeader: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthCustomHeader - type: 'null' googleServiceAccount: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthGoogleServiceAccount - type: 'null' mcpServerCatalogId: description: >- Opaque catalog entry ID (27-character KSUID). Obtain valid IDs from the ListCatalog or GetCatalog RPCs. type: string none: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerAuthNone' - type: 'null' oauth2: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerAuthOAuth2' - type: 'null' requireToolApproval: description: |- Optional per-server override for tool auto-approval. See MCPServerView.require_tool_approval for semantics. enum: - OPTIONAL_BOOL_UNSPECIFIED - OPTIONAL_BOOL_TRUE - OPTIONAL_BOOL_FALSE type: string x-speakeasy-unknown-values: allow sourceAppId: description: Source app ID (optional, for connector-backed servers). type: string tokenSharing: description: |- Token sharing model for the configured auth method. SHARED means the admin authorizes once and the credential applies to every tool call; PER_USER means each user authenticates independently. PER_USER is supported for OAuth2 authorization-code, bearer_token, custom_header, and basic_auth methods; sending PER_USER alongside any other auth method is rejected with InvalidArgument. enum: - MCP_SERVER_TOKEN_SHARING_UNSPECIFIED - MCP_SERVER_TOKEN_SHARING_SHARED - MCP_SERVER_TOKEN_SHARING_PER_USER type: string x-speakeasy-unknown-values: allow title: Mcp Server Hosted Config type: object x-speakeasy-name-override: MCPServerHostedConfig c1.api.ai_governance.v1.MCPServerView: description: >- MCPServerView is the API representation of an MCP server (backed by a Connector). properties: appId: description: App identifier that owns this MCP server. type: string authMethod: description: Authentication method in use. Read-only; derived from stored config. enum: - MCP_SERVER_AUTH_METHOD_UNSPECIFIED - MCP_SERVER_AUTH_METHOD_NONE - MCP_SERVER_AUTH_METHOD_BEARER_TOKEN - MCP_SERVER_AUTH_METHOD_OAUTH2 - MCP_SERVER_AUTH_METHOD_CUSTOM_HEADER - MCP_SERVER_AUTH_METHOD_AWS_SIGV4 - MCP_SERVER_AUTH_METHOD_BASIC_AUTH type: string x-speakeasy-unknown-values: allow awsAccessKeyId: description: |- AWS SigV4 access key ID (the public half of the credential pair). Read-only; derived from stored config. Surfaced so the edit form can pre-fill the field on load without exposing the sealed secret. readOnly: true type: string awsSecretAccessKeyConfigured: description: Whether an AWS SigV4 secret access key is configured. Read-only. readOnly: true type: boolean awsSessionTokenConfigured: description: |- Whether an AWS SigV4 session token is configured (optional, only for STS temporary credentials). Read-only. readOnly: true type: boolean basicAuthPasswordConfigured: description: >- Whether a basic-auth password is configured (admin-supplied for SHARED, irrelevant for PER_USER). Read-only; derived from stored config. readOnly: true type: boolean basicAuthUsername: description: The username configured for basic-auth. Read-only. readOnly: true type: string bearerTokenConfigured: description: |- Whether a bearer-token credential is configured (admin-supplied for SHARED, irrelevant for PER_USER). Read-only; derived from stored config. Mirrors oauth2_credentials_configured for the bearer-token auth method so the edit form can render the password input as "configured" without exposing the sealed bytes. readOnly: true type: boolean configFieldValues: additionalProperties: type: string description: >- Non-secret configuration field values keyed by catalog config field name. Read-only; populated from the stored config. Secret fields are omitted. readOnly: true type: object connectorId: description: Unique identifier (connector ID). type: string createdAt: format: date-time readOnly: true type: - string - 'null' credentialsSetupUrl: description: >- Deep link to the server's detail page in the C1 admin UI, where an admin enters or rotates credentials in the browser. Lets an agent hand its human a clickable link for credential entry so the secret value never transits the agent transcript. Empty when the tenant frontend URL can't be resolved. Read-only. readOnly: true type: string customHeaderName: description: |- The HTTP header name configured for custom-header auth. Read-only; derived from stored config. Surfaced so the admin edit form can pre-fill the field on load — without this, the form shows blank and the admin has to retype it on every edit (which loses the value if they only meant to flip token_sharing). readOnly: true type: string customHeaderValueConfigured: description: >- Whether a custom-header value is configured (admin-supplied for SHARED, irrelevant for PER_USER). Read-only; derived from stored config. readOnly: true type: boolean dataSensitivity: description: Data sensitivity classification. enum: - MCP_SERVER_DATA_SENSITIVITY_UNSPECIFIED - MCP_SERVER_DATA_SENSITIVITY_PUBLIC - MCP_SERVER_DATA_SENSITIVITY_INTERNAL - MCP_SERVER_DATA_SENSITIVITY_CONFIDENTIAL - MCP_SERVER_DATA_SENSITIVITY_RESTRICTED type: string x-speakeasy-unknown-values: allow defaultToolPrefix: description: >- Default tool-name prefix used when tool_prefix is unset (the hosted impl's server_prefix / service name); empty for external or legacy servers. Read-only. readOnly: true type: string description: description: Admin-provided description. type: string displayName: description: Admin-provided display name. type: string endpointUrl: description: Endpoint URL for external MCP servers. Read-only. readOnly: true type: string lastCalledAt: format: date-time readOnly: true type: - string - 'null' mcpServerCatalogId: description: |- Opaque catalog entry ID for hosted MCP servers (27-character KSUID). Obtain valid IDs from the ListCatalog or GetCatalog RPCs. type: string oauth2AuthorizeUrl: description: OAuth2 authorization URL. Read-only; derived from stored config. readOnly: true type: string oauth2ClientId: description: >- OAuth2 client ID (non-secret). Read-only; derived from stored config. readOnly: true type: string oauth2ClientIdMode: description: >- How the OAuth2 client_id was acquired (manual / DCR / CIMD). Read-only; derived from stored config. Empty for non-authorization_code servers. enum: - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_UNSPECIFIED - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_DCR - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_CIMD readOnly: true type: string x-speakeasy-unknown-values: allow oauth2ClientSecretExpiresAt: description: |- RFC 7591 client_secret expiry (unix seconds; 0 = never). Read-only; derived from stored config. Surfaced for display only. format: int64 readOnly: true type: string oauth2CodeChallengeMethodsSupported: description: |- PKCE code-challenge methods the IdP advertised at registration. Read-only; derived from stored config. Surfaced so the edit form's change detection can compare against the saved value rather than an implicit empty default — without this, re-running Discover on a server with stable methods always reports the field as changed and fires a spurious UpdateCredentials. items: type: string readOnly: true type: - array - 'null' oauth2CredentialsConfigured: description: >- Whether OAuth2 client credentials (client_id + client_secret) are configured. Read-only. readOnly: true type: boolean oauth2ExtraAuthorizeParams: additionalProperties: type: string description: >- Static query params appended to the OAuth2 authorize URL. Read-only on the view; the edit form surfaces this as an editable key/value list. Empty for non-authorization_code servers. readOnly: true type: object oauth2ExtraTokenParams: additionalProperties: type: string description: >- Extra body params POSTed to the OAuth2 token endpoint. Read-only on the view; the edit form takes this value and surfaces it as an editable key/value list. Empty for non-OAuth2 / non-client-credentials servers. readOnly: true type: object oauth2IssuerUrl: description: >- OAuth2 issuer URL. Read-only; derived from stored config. Surfaced so the registration UI can prefill the Discover input box on edit. readOnly: true type: string oauth2JwtAudience: description: JWT audience claim. Read-only. readOnly: true type: string oauth2JwtIssuer: description: JWT issuer (service account email). Read-only. readOnly: true type: string oauth2JwtPrivateKeyConfigured: description: Whether a JWT private key is configured. Read-only. readOnly: true type: boolean oauth2JwtSubject: description: JWT subject (domain-wide delegation). Read-only. readOnly: true type: string oauth2Mode: description: OAuth2 mode in use. Read-only; derived from stored config. enum: - MCP_SERVER_AUTH_OAUTH2_MODE_UNSPECIFIED - MCP_SERVER_AUTH_OAUTH2_MODE_SERVICE - MCP_SERVER_AUTH_OAUTH2_MODE_PASSTHROUGH - MCP_SERVER_AUTH_OAUTH2_MODE_CLIENT_CREDENTIALS - MCP_SERVER_AUTH_OAUTH2_MODE_JWT_BEARER - MCP_SERVER_AUTH_OAUTH2_MODE_GOOGLE_SERVICE_ACCOUNT - MCP_SERVER_AUTH_OAUTH2_MODE_AUTHORIZATION_CODE readOnly: true type: string x-speakeasy-unknown-values: allow oauth2Pkce: description: >- PKCE behavior for authorization_code mode: "discover" (or empty), "s256", or "disabled". Read-only on the view. Empty for non-authorization_code servers. readOnly: true type: string oauth2Scopes: description: OAuth2 scopes. Read-only; derived from stored config. items: type: string readOnly: true type: - array - 'null' oauth2ScopesSupported: description: |- OAuth scopes the IdP advertised in its discovery doc at the most recent Discover. Read-only; derived from stored config. Surfaced so the edit form can populate the Scopes chips-input autocomplete from a previously-discovered list without forcing the admin to re-run Discover. Distinct from oauth2_scopes (= the requested subset). items: type: string readOnly: true type: - array - 'null' oauth2ServiceAuthorized: description: Whether a service-mode OAuth2 credential exists. Read-only. readOnly: true type: boolean oauth2ServiceAuthorizedAsEmail: description: >- Email of the external identity authorized (from ID token). Read-only. readOnly: true type: string oauth2ServiceAuthorizedAsName: description: >- Display name of the external identity authorized (from ID token). Read-only. readOnly: true type: string oauth2ServiceAuthorizedAt: format: date-time readOnly: true type: - string - 'null' oauth2ServiceAuthorizedBy: description: >- Passport user ID of who authorized the service-mode OAuth2 credential. Read-only. readOnly: true type: string oauth2TokenEndpointAuthMethod: description: >- RFC 7591 token_endpoint_auth_method the authorization server assigned ("none" for public PKCE-only clients). Read-only; server-set from the DCR result. Empty for manual / non-DCR servers. readOnly: true type: string oauth2TokenUrl: description: OAuth2 token URL. Read-only; derived from stored config. readOnly: true type: string requireToolApproval: description: Per-server override for tool auto-approval. enum: - OPTIONAL_BOOL_UNSPECIFIED - OPTIONAL_BOOL_TRUE - OPTIONAL_BOOL_FALSE type: string x-speakeasy-unknown-values: allow serverType: description: Whether this is a hosted MCP server. enum: - MCP_SERVER_TYPE_UNSPECIFIED - MCP_SERVER_TYPE_HOSTED - MCP_SERVER_TYPE_EXTERNAL type: string x-speakeasy-unknown-values: allow sourceAppId: description: Source app ID (hosted servers only). type: string tokenSharing: description: |- Token sharing model in use. Read-only; derived from stored config. For rows stored under the legacy SERVICE/PASSTHROUGH OAuth2 modes, this is synthesized as SHARED/PER_USER respectively. enum: - MCP_SERVER_TOKEN_SHARING_UNSPECIFIED - MCP_SERVER_TOKEN_SHARING_SHARED - MCP_SERVER_TOKEN_SHARING_PER_USER readOnly: true type: string x-speakeasy-unknown-values: allow toolPrefix: description: |- Admin-configured prefix for tool names in the C1 MCP server. Tools are exposed as "_". When empty, the system uses an auto-derived prefix (service name or hostname). type: string transportType: description: Transport type for external MCP servers. Read-only. enum: - MCP_SERVER_TRANSPORT_TYPE_UNSPECIFIED - MCP_SERVER_TRANSPORT_TYPE_STREAMABLE_HTTP - MCP_SERVER_TRANSPORT_TYPE_SSE readOnly: true type: string x-speakeasy-unknown-values: allow tunnelApplianceId: description: >- Credential id (cutename) used to route tool calls through the bridge. Set only when tunneled == true. Read-only. readOnly: true type: string tunnelBridgeId: description: >- ID of the bridge (TunnelConnection.id, a KSUID) that proxies this server. Set only when tunneled == true. Read-only. readOnly: true type: string tunnelServiceName: description: |- Bridge-announced service name used to route to this server. Set only when tunneled == true. Read-only. readOnly: true type: string tunneled: description: |- Whether the MCP server is reached over a tunnel to a private bridge appliance instead of a public URL. Read-only. readOnly: true type: boolean updatedAt: format: date-time readOnly: true type: - string - 'null' title: Mcp Server View type: object x-speakeasy-name-override: MCPServerView c1.api.ai_governance.v1.MCPServerAuthBasicAuth: description: |- MCPServerAuthBasicAuth provides HTTP Basic authentication (RFC 7617). The gateway encodes `username:password` as base64 and sends it as `Authorization: Basic ` on every outbound request. properties: password: description: |- Password. Sealed before storage; never returned on read. ignore_empty for the same PER_USER reason as username above. type: string username: description: |- Username. Sent in plaintext over TLS; stored unsealed on the connector config (mirrors how MCPAuthOAuth2.client_id is plaintext). ignore_empty mirrors MCPServerAuthBearerToken.token — PER_USER admin submits don't carry a username; the handler enforces non-empty for SHARED. type: string title: Mcp Server Auth Basic Auth type: object x-speakeasy-name-override: MCPServerAuthBasicAuth c1.api.ai_governance.v1.MCPServerAuthBearerToken: description: MCPServerAuthBearerToken provides bearer token authentication. properties: token: description: The bearer token value. type: string title: Mcp Server Auth Bearer Token type: object x-speakeasy-name-override: MCPServerAuthBearerToken c1.api.ai_governance.v1.MCPServerAuthCustomHeader: description: MCPServerAuthCustomHeader provides custom header authentication. properties: headerName: description: HTTP header name. type: string headerValue: description: HTTP header value. type: string title: Mcp Server Auth Custom Header type: object x-speakeasy-name-override: MCPServerAuthCustomHeader c1.api.ai_governance.v1.MCPServerAuthNone: description: MCPServerAuthNone indicates no authentication is required. title: Mcp Server Auth None type: object x-speakeasy-name-override: MCPServerAuthNone c1.api.ai_governance.v1.MCPServerAuthOAuth2: description: >- MCPServerAuthOAuth2 provides OAuth2 client credentials or JWT Bearer authentication. properties: authorizeUrl: description: >- OAuth2 authorization endpoint URL (for service and passthrough modes). type: string clientId: description: >- OAuth2 client identifier. Required for CLIENT_CREDENTIALS mode; not used for JWT_BEARER mode. type: string clientIdMode: description: >- How the client_id is acquired for authorization_code mode. When DCR (or CIMD), client_id / client_secret are not required on input — the gateway registers itself with the authorization server during Register and injects the result. UNSPECIFIED means manual (admin-entered client_id). enum: - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_UNSPECIFIED - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_DCR - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_CIMD type: string x-speakeasy-unknown-values: allow clientSecret: description: >- OAuth2 client secret. Required for CLIENT_CREDENTIALS mode; not used for JWT_BEARER mode. type: string codeChallengeMethodsSupported: description: >- PKCE code challenge methods supported by the authorization server, as returned by DiscoverOIDCEndpoints. Optional registration-time shortcut that lets the gateway skip the per-flow xjwks.Cache lookup. Capped at 8 entries because RFC 7636 / RFC 8414 only define a tiny enumerated set ("plain", "S256") and we don't want to be a dumping ground for arbitrary strings the IdP might emit. items: type: string type: - array - 'null' extraAuthorizeParams: additionalProperties: type: string description: >- Static query params appended to the authorize URL on top of the standard OAuth2 fields (e.g. Notion "owner=user"). Applies to authorization_code mode only. Inherited from MCPServerCatalogAuthMode.extra_authorize_params at registration time. type: object extraTokenParams: additionalProperties: type: string description: >- Extra body params POSTed to the token endpoint on top of the standard OAuth2 fields. Provider-specific (e.g. Auth0/Wiz "audience"). Applies to client_credentials mode only; other modes ignore it. Inherited from MCPServerCatalogAuthMode.extra_token_params at registration time; admins can add, edit, or remove entries on the edit form. type: object issuerUrl: description: |- OIDC issuer URL (no trailing path). Used as the cache key for live PKCE-methods discovery via xjwks.Cache on the gateway. Populated by the Discover button or hand-entered alongside authorize_url/token_url. Required for SERVICE / PASSTHROUGH modes. type: string jwtAudience: description: >- Audience claim for the JWT. When empty, token_url is used as the audience. type: string jwtIssuer: description: The service account email / issuer claim. type: string jwtPrivateKey: description: >- PEM-encoded RSA private key (plaintext in API; sealed before storage). type: string jwtSubject: description: Optional subject for domain-wide delegation. type: string mode: description: OAuth2 mode. enum: - MCP_SERVER_AUTH_OAUTH2_MODE_UNSPECIFIED - MCP_SERVER_AUTH_OAUTH2_MODE_SERVICE - MCP_SERVER_AUTH_OAUTH2_MODE_PASSTHROUGH - MCP_SERVER_AUTH_OAUTH2_MODE_CLIENT_CREDENTIALS - MCP_SERVER_AUTH_OAUTH2_MODE_JWT_BEARER - MCP_SERVER_AUTH_OAUTH2_MODE_GOOGLE_SERVICE_ACCOUNT - MCP_SERVER_AUTH_OAUTH2_MODE_AUTHORIZATION_CODE type: string x-speakeasy-unknown-values: allow pkce: description: |- PKCE behavior for authorization_code mode: "discover" (or empty), "s256", or "disabled". Inherited from MCPServerCatalogAuthMode.pkce. type: string scopes: description: OAuth2 scopes to request. items: type: string type: - array - 'null' scopesSupported: description: |- Full list of OAuth scopes the IdP advertises in its discovery doc (`scopes_supported`). Distinct from the `scopes` field above, which is the curated subset the admin wants requested on the authorize URL. Captured at registration time so the edit form can offer autocomplete suggestions on the Scopes input without forcing the admin to re-run Discover. Capped at 256 because providers like Salesforce return ~36; 256 leaves headroom without inviting abuse. items: type: string type: - array - 'null' tokenEndpointAuthMethod: description: >- RFC 7591 token_endpoint_auth_method the authorization server assigned. Read-only / ignored on write: server-set from the DCR result, never copied from the API request into the stored model. Surfaced for display only. type: string tokenUrl: description: |- OAuth2 token endpoint URL. Required for all modes when creating or rotating; uses ignore_empty so partial UpdateCredentials calls that omit this path pass protovalidate. The handler enforces required-on-create. type: string title: Mcp Server Auth O Auth 2 type: object x-speakeasy-name-override: MCPServerAuthOAuth2 c1.api.ai_governance.v1.MCPServerAuthAWSSigV4: description: |- MCPServerAuthAWSSigV4 provides AWS Signature Version 4 authentication. Used for hosted MCP servers backed by AWS service impls (the amazonaws_com_* catalog entries). Outbound requests from the gateway are signed per-request with the supplied access key + secret, against the service+region scope sourced from the impl bundle's connect.auth. Only the SHARED token-sharing model is supported — every caller in the tenant signs with the same admin-configured credentials. Per-user AWS (STS / Web Identity / IAM Identity Center) is a separate future surface. properties: accessKeyId: description: |- AWS access key ID (the IAM user / role's public identifier, e.g. "AKIAIOSFODNN7EXAMPLE"). Persisted in plaintext form; the secret half is sealed. type: string secretAccessKey: description: >- AWS secret access key. Sealed by the backend on write; never returned on read. type: string sessionToken: description: |- Optional AWS session token. Set only when the credential is a short-lived STS temporary credential. Static IAM-user keys leave this empty. type: string title: Mcp Server Auth Aws Sig V 4 type: object x-speakeasy-name-override: MCPServerAuthAWSSigV4 c1.api.ai_governance.v1.MCPServerAuthGoogleServiceAccount: description: >- MCPServerAuthGoogleServiceAccount provides Google service account authentication. The admin uploads the raw JSON key file from the GCP console; the backend parses it to extract the private key, client email (issuer), and token URI. properties: credentialsJson: description: Raw JSON content of the Google service account key file. type: string scopes: description: >- OAuth2 scopes to request when exchanging the JWT for an access token. items: type: string type: - array - 'null' title: Mcp Server Auth Google Service Account type: object x-speakeasy-name-override: MCPServerAuthGoogleServiceAccount securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````