> For the complete documentation index, see [llms.txt](https://mcp-docs.nichefire.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mcp-docs.nichefire.com/quick-start/authentication/authentication-through-oauth-2.1.md).

# Authentication through OAuth 2.1

OAuth 2.1 is the recommended authentication method for consumer AI clients that support OAuth-based connectors ( such as ChatGPT Apps / Claude Plugins ). You sign in through your browser and approve the connection once. The client then stores and refreshes the resulting credential automatically.

No API key needs to be copied, stored, or manually rotated.

{% hint style="info" %}
For scripts, backend integrations, and custom agents, **API Key Authentication** is generally more appropriate.
{% endhint %}

### How it works

1. In your client, add an MCP server or connector pointing at the Nichefire MCP URL.
2. The client registers itself with Nichefire automatically. No manual client registration is required.
3. The client redirects you to the Nichefire sign-in page.
4. Sign in with your Nichefire account and approve the connection.
5. The client completes the authorization process and makes the tools available.

After authorization, the client securely stores the resulting credential and refreshes it in the background. The connection therefore remains active across sessions without requiring you to sign in again under normal circumstances.

### No key handling required

OAuth does not require you to view or manage an API key. The client handles the authorization exchange and stores the resulting credential.

Each person should authorize their own connection using their individual Nichefire account. OAuth credentials should not be transferred or shared.

### Disconnecting and Revoking Access

Removing the connector from your AI client ends the connection on that client.

For situations requiring server-side revocation—such as a lost device, a compromised account, or a user leaving the organization—contact your Nichefire representative.

### Troubleshooting

| What you see                                                | What it usually means                                                                                                                                          |
| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Sign-in succeeds but the connection is rejected             | Your Nichefire account is not linked to an organization with MCP access. [Contact](/help-and-support/contact-us.md) your Nichefire representative.             |
| The connector appears with no tools, or fewer than expected | Your organization is not entitled to those capability families. See [Capabilities](/overview/capabilities.md).                                                 |
| The client never reaches a sign-in page                     | The client does not support OAuth for remote MCP servers. Use [API key authentication](/quick-start/authentication/authentication-through-api-key.md) instead. |
| You are asked to sign in again unexpectedly                 | The stored credential expired or was revoked. Signing in again restores access.                                                                                |

Once you have verified your client supports OAuth 2.1 and are ready to setup an integration, continue to [Supported Integrations](/quick-start/supported-integrations.md).