Walkthrough: Securing your MCP Deployment with Auth0

When you deploy a Blawx project as an MCP server, it sits on the open internet. OAuth is how you decide who gets to use it.

OAuth is the standard that lets one service trust another service's answer to "who is this person, and what are they allowed to do?" You have used it every time you clicked "sign in with Google" on a site that is not Google. The service that holds the accounts and answers the question is called an OAuth provider. Blawx does not answer it — your deployed MCP server simply refuses anyone who does not arrive with a valid pass from the provider you nominated.

Any OAuth provider will do: Okta, Microsoft Entra, Keycloak, your firm's existing single sign-on. This post uses Auth0 because it has a free tier and is quick to set up. The steps are Auth0-specific; the shape of what you are doing is not.

What you are building

Once this is configured, the workflow is:

1. You add a user to your OAuth provider and assign them a role that carries permission to use your MCP server.
2. You give them the MCP server's address.
3. They add that address to Claude, Codex, or another MCP client.
4. They are sent to your provider to log in, then asked to authorize the connection.
5. The MCP server works for them.

Anyone without that role can still log in and still gets nothing. That is the point.

Before you start

Deploy the project and copy the deployment's server URL from the Blawx workbench:

You will paste that exact string twice. Copy it; do not retype it.

In Auth0

You will need to register for an Auth0 account.

1. Create the API. Applications → APIs → Create API. Name it anything. Set Identifier to your deployment's server URL, in full. Leave Signing Algorithm as RS256.

2. Add the permission. Open the API → Permissions tab → add blawx:query.

3. Turn on RBAC. Same API → Settings tab → switch on Enable RBAC and Add Permissions in the Access Token. Save.

4. Set the baseline permission for outside clients. Same Settings tab → Default Permissions for Third Party Apps → choose Authorized for User Access → tick blawx:query. Save. (If it is not on the API page, look under Settings → Advanced.)

5. Create the role. User Management → Roles → Create Role. Open it → Permissions tab → Add Permissions → select your API → tick blawx:query.

6. Assign the role. User Management → Users → open a user → Roles tab → assign the role. Repeat for each person who should have access.

7. Allow clients to register themselves. Settings → Advanced → switch on OIDC Dynamic Application Registration and Resource Parameter Compatibility Profile. Save.

8. Promote your login connection. Authentication → Database → open your connection (Username-Password-Authentication by default) → Settings → switch on Promote Connection to Domain Level. Save. Repeat for any social login connections your users use.

9. Note your tenant address. It is on the dashboard home page, or in the Domain field of any application's settings: dev-a1b2c3.us.auth0.com.

In Blawx

Edit the deployment's authentication settings:

• Issuer: https://dev-a1b2c3.us.auth0.com/ — your tenant address, with https:// in front and a trailing slash. Both are required.
• Audience: the same string you used as the API Identifier in step 1.
• Required scope: blawx:query
• Discovery URL: leave blank.

Save, and make sure the deployment is enabled. Allow a minute for the change to take effect.

Testing it

Add the deployment's server URL to an MCP client. You should be sent to your Auth0 login page, then to a consent screen, and then the deployment's tools should be available.

If a client was connected to this deployment before you configured authentication, remove the connection and add it again rather than reconnecting.

One warning

Auth0's free tier caps how many applications your tenant can hold, and every connection attempt creates one. With active testing you will run out quickly, at which point connections fail with no useful error. Delete the accumulated entries under Applications → Applications.