Next Steps
Signed in, workspace created, dashboard toured. Each step below builds on the last.
1. Protect your first MCP serverâ
Register an Application, drop the SDK into your server, and launch -- the core workflow that everything else plugs into.
| Guide | What you'll do |
|---|---|
| Protect an application | Step-by-step dashboard walkthrough with screenshots (10 steps) |
| From zero to launched | Condensed version â the five-step flow in one page |
| Python SDK â protect | Code-focused: mount_mcp, config, handler forms, class reference |
| Environment setup | Copy-paste env var blocks for .env, bash, PowerShell, Docker, Kubernetes |
2. Connect agents and servicesâ
Once a server is protected, something needs to call it with a token:
Machine-to-machine (no user in the loop)â
A pipeline, cron job, or backend service acting as itself -- three credential types, simplest to strongest:
| Method | Guide |
|---|---|
| Client secret (shared secret) | Client secret |
| Private-key JWT (RFC 7523, no shared secret) | Private-key JWT |
| Kubernetes / SPIFFE (zero stored credentials) | Kubernetes / SPIFFE |
All three start at Service Accounts in the dashboard. Decision guide: Connect agents and services.
On behalf of a user (ID-JAG delegation)â
A copilot or chatbot acting with a signed-in user's permissions -- the user consents once, an admin approves once, either can revoke at any time.
Starts at the Agents page in the dashboard.
3. Configure access controlâ
Fine-tune who can call what:
| Task | Where |
|---|---|
| Define scopes (the permission vocabulary) | Application â Scopes tab (guide) |
| Map tools to scopes (deny by default) | Application â Tools tab (guide) |
| Create roles and grant scopes to them | Application â Roles + Access tabs (guide) |
| Set a default role for new callers | Application â Access tab â role â® menu â Make default |
4. Wire identity infrastructure (when you need it)â
| Task | Dashboard section |
|---|---|
| Connect an OIDC / SAML identity provider | CONFIGURE â Identity Providers (guide) |
| Import users from Active Directory / Entra ID | CONFIGURE â Directory Sync |
| Push user provisioning via SCIM 2.0 | CONFIGURE â SCIM Connections |
| Register a SPIRE trust domain for workload identity | SETTINGS â Trusted Issuers (guide) |
5. Monitorâ
| What | Where |
|---|---|
| Auth events (logins, consent, token grants) | MONITOR â Auth Logs |
| Administrative changes (role edits, scope changes) | MONITOR â Audit Logs |
| M2M token activity | MONITOR â M2M Logs |
| Per-application runtime status and drift | Application â Monitor tab (guide) |
SDK referenceâ
| Language | Guide |
|---|---|
| Python | Python SDK (v4.7.0+) |
| Go | Go SDK |
| TypeScript | TypeScript SDK |
Need help?â
- Email: support@authsec.ai
- GitHub: github.com/authsec-ai