Skip to main content

OAuth Configuration

Configure OAuth authentication for MCP servers that require user authorization.

OAuth Overview​

OAuth allows users to authorize your chatbot to access their data in external services without sharing passwords.

Authentication Types​

TypeDescriptionUse Case
User OAuthEach user authorizesPersonal data access
CentralizedAdmin authorizes onceShared data access
API KeySingle keySimple integrations

User OAuth Flow​

  1. User interacts with chatbot
  2. Chatbot needs external data
  3. User is prompted to authorize
  4. User logs into external service
  5. Access is granted
  6. Chatbot can access data

Setting Up User OAuth​

  1. Go to "Settings" > "Integrations"
  2. Select the integration
  3. Choose "User OAuth"
  4. Configure OAuth settings:
    • Client ID
    • Client Secret
    • Scopes
  5. Click "Save"

OAuth Credentials​

You'll need from the service provider:

FieldDescription
Client IDYour app identifier
Client SecretYour app secret
Redirect URIWizChat callback URL
ScopesPermissions requested

Getting OAuth Credentials​

Salesforce:

  1. Create a Connected App in Salesforce Setup
  2. Enable OAuth settings
  3. Copy Client ID and Secret

Atlassian:

  1. Create an app in Atlassian Developer Console
  2. Configure OAuth 2.0
  3. Copy credentials

Google:

  1. Create project in Google Cloud Console
  2. Enable required APIs
  3. Create OAuth credentials

Centralized Credentials​

For shared access where all users see the same data:

  1. Go to "Settings" > "Integrations"
  2. Select the integration
  3. Choose "Centralized"
  4. Click "Connect"
  5. Authorize with admin account
  6. All chatbot users share this access

When to Use Centralized​

  • Accessing shared company data
  • When users don't have individual accounts
  • For read-only data access

Security Considerations​

  • Admin credentials access all data
  • Users see admin's accessible data
  • Use read-only scopes when possible

Connecting from the chat​

Some MCP servers (for example a Microsoft / SharePoint server) authorize each visitor individually rather than through a single admin connection. For these, the visitor connects directly from the chat widget's MCP menu:

  1. The visitor opens the MCP menu in the chat and finds the server.
  2. They click Connect and sign in to the provider in a popup window. If the browser blocks the popup, WizChat falls back to a full-page redirect and returns to the chat when authorization completes.
  3. Once authorized, the server shows as connected and its tools become available in that conversation. The connection is tied to the visitor's own provider account, and the browser remembers it so they don't have to reconnect on every visit.
  4. The visitor can Disconnect from the same menu at any time, which removes their stored authorization for that server.

Access to an OAuth MCP server can also be restricted to specific users or groups. When a server is limited to an allowed group, only members of that group see it in the MCP menu; everyone else never sees the server or its tools.

Managing OAuth Tokens​

View Connected Accounts​

  1. Go to "Settings" > "Integrations"
  2. Click on the integration
  3. View connected accounts

Revoke Access​

  1. Find the connected account
  2. Click "Revoke"
  3. Confirm revocation

Token Refresh​

Tokens are automatically refreshed when:

  • Token expires
  • New request is made
  • Background refresh runs

User Experience​

Authorization Prompt​

Users see an authorization prompt when:

  • First using an OAuth-protected feature
  • Token has expired and can't refresh
  • Permissions change

Handling Denied Access​

If a user denies authorization:

  • Chatbot gracefully handles the denial
  • Alternative responses are provided
  • User can authorize later

Troubleshooting​

Authorization Failed​

  • Verify OAuth credentials
  • Check redirect URI configuration
  • Ensure required scopes are correct

Token Expired​

  • Refresh token should auto-refresh
  • If not, user may need to re-authorize
  • Check token lifetime settings

Scope Issues​

  • Verify scopes match provider settings
  • Some providers require exact scope strings
  • Additional scopes may need approval