https://mcp.authaction.com

Add sign-in from your coding agent

Connect Claude Code, Cursor or VS Code to your AuthAction account. Your agent creates the application, sets the callback URLs, turns on login methods and writes the config into your app. When your API answers 401, it tells you why.

Get Started Free Read the docs

Connect in one line

Claude Code

claude mcp add --transport http authaction https://mcp.authaction.com

Cursor, VS Code and other MCP clients

https://mcp.authaction.com

The first time a tool runs, your client opens the AuthAction sign-in page. No API keys to create or paste. Your agent sees the same tenants you see in the dashboard, and nothing more.

From "add login" to a working config

Ask for sign-in and the agent does the setup you would otherwise click through: a public client with PKCE for your front end, your local callback URL, a login method, and the API audience if you have a backend.

Then integration_config_get hands it everything in one call: domain, issuer, endpoints, client ID, the flow to use and environment variables named the way the AuthAction SDKs name them. It also warns about setups that would fail, like an application with no callback URL.

Client secrets never reach the agent. Backend applications get a placeholder and a note to copy the secret from the dashboard.

> Add AuthAction login to this Next.js app

applications_create name: "web", type: "spa"

applications_update callbackUrls: ["http://localhost:3000/callback"]

connections_enable_client google

integration_config_get

flow: authorization_code, pkce: true, clientSecretRequired: false

warnings: []

# .env.local

AUTHACTION_DOMAIN=acme.eu.authaction.com

AUTHACTION_CLIENT_ID=m4WZQFVVv72hTyvLZsX6fI7E2TXZAhl6

AUTHACTION_REDIRECT_URI=http://localhost:3000/callback

AUTHACTION_AUDIENCE=https://api.acme.dev

"Why does my API say 401?"

token_inspect checks a token against your tenant: signature, issuer, audience and expiry. Then it says what is wrong in plain words, most likely cause first.

Expired, and how long ago
Issued by a different tenant or environment
An ID token sent where an access token belongs
An audience that isn't one of your APIs
A token cut short when it was copied

> My API rejects this token, can you check it?

token_inspect

kind: id_token

valid: false

checks: signature valid, issuer matches, expires in 54 minutes

problems:

- This is an ID token (its audience is an application).

APIs expect an access token: request one with

audience set to the API identifier and send that.

Ask about your users

The same connection answers product questions. users_stats counts sign-ups per day and per login method for any range, and users_list filters by sign-up date.

Want an agent that can look but not touch? Connect to https://mcp.authaction.com/read instead.

> How many people signed up last week, and how?

users_stats from: 2026-10-26, to: 2026-11-02

total: 41

byConnection: google 27, email-password 11, github 3

41 sign-ups last week. Two thirds came through Google;

Tuesday was the busiest day with 12.

What your agent can do

Over 60 tools, generated from the same API the dashboard uses

Applications

Create clients, set callback and logout URLs, get the full config.

applications_create applications_update integration_config_get

Login methods

Add social, email and enterprise connections and turn them on per app.

connections_create connections_enable_client connections_list

Your APIs

api_servers_create api_servers_enable_client

Users and roles

Create test users, define roles and assign them.

users_create roles_create users_add_roles

Token debugger

Find out exactly why a token is or isn't accepted.

token_inspect

Sign-ups and tenants

Sign-up counts, users by date, tenants, members and email logs.

users_stats users_list email_logs_list

Safe to hand to an agent

Agents read transcripts back, retry and improvise. The server is built for that.

Your permissions

You sign in with your own AuthAction account. Every tool call runs as you, through the same API and checks as the dashboard.

No secrets in transcripts

Client secrets, social login secrets, SAML keys and LDAP passwords are never returned. A connection only says whether its secret is set.

A real read-only mode

Tokens for /read can't make changes through MCP or by calling the API directly. The API refuses them for anything but reads.

Nothing to delete with

There are no tools that delete applications, connections, APIs or users. Removing those stays a deliberate step in the dashboard.

Let your agent set up sign-in

Free, like the rest of AuthAction: unlimited users, no MAU tiers.