Skip to main content
This guide covers connecting Auth0 to a specific MCPCore server, and enabling resource indicators so Auth0 issues tokens with the correct aud claim. Read OAuth 2.0 Mode first if you have not already, it covers the parts of this flow that are the same for every provider.

​
1. Create an API for your MCPCore server

  1. Log in to manage.auth0.com and open your tenant.
  2. Go to Applications → APIs → Create API.
  3. Set:
    • Name: something recognizable, for example MCPCore - your-subdomain
    • Identifier: https://{your-subdomain}.mcpcore.io/mcp, this must match your MCPCore resource URL exactly, including the /mcp path
    • Signing Algorithm: RS256
  4. Save the API.
The Identifier is what Auth0 places in the aud claim of tokens issued for this API. If you run multiple MCPCore servers behind the same Auth0 tenant, create one API per server, each with its own Identifier matching that server’s resource URL.

​
2. Enable resource indicators

Auth0 supports Resource Indicators for OAuth 2.0 so that a single application can request tokens for multiple APIs by sending a resource parameter, which is exactly what MCP clients do.
  1. In your Auth0 tenant, go to Settings → Advanced.
  2. Under OIDC Conformant, confirm it is enabled (default for tenants created after 2017).
  3. Auth0 maps an incoming resource value to the API whose Identifier matches it. As long as the Identifier from step 1 matches your MCPCore resource URL exactly, no further mapping step is required.
If your tenant predates OIDC Conformant mode, Auth0 support can migrate it. Non-conformant tenants do not honor the resource parameter reliably.

​
3. Confirm Dynamic Client Registration

Auth0’s /.well-known/oauth-authorization-server metadata for your tenant includes a registration_endpoint by default, which is what lets MCP clients like Claude and Cursor register themselves without you creating an Application manually in the Auth0 dashboard. Verify this by fetching your metadata URL directly:
Confirm registration_endpoint and jwks_uri are both present.

​
4. Allow refresh tokens (optional)

If you want MCP clients to stay connected without repeated logins:
  1. On your API (step 1), go to the Settings tab.
  2. Enable Allow Offline Access.
  3. In the Auth0 Application created via Dynamic Client Registration, refresh token rotation is on by default for OIDC-conformant tenants.

​
5. Configure MCPCore

1

Open Server Settings

Go to your server’s Settings tab in the MCPCore dashboard.
2

Select OAuth 2.0

Under Security mode, select OAuth 2.0.
3

Paste the metadata URL

4

Leave Legacy token audience off

Since your API Identifier matches your MCPCore resource URL, tokens will already carry the correct aud. You do not need the legacy audience fallback.
5

Save

MCPCore validates the metadata URL and activates OAuth 2.0 mode.

​
Verifying the token audience

After connecting an MCP client once, you can decode the access token (for example on jwt.io, paste only the token, never a real user’s token into a third-party tool for anything beyond local debugging) and confirm:
If aud is instead an array containing your Auth0 tenant’s own domain, or missing entirely, the API Identifier from step 1 does not match your MCPCore resource URL, check for a trailing slash or a missing /mcp path.

​
Common pitfalls