Skip to main content
Authentication determines how your MCP server gets credentials to access external services. Choose the right pattern based on who provides the credentials and how they should be managed.
Auth type cannot be changed after server creation. Choose carefully!

OAuth

Best for services where users need to connect their own accounts. Gumstack handles the OAuth flow, token storage, and automatic refresh—you just implement the provider.

Configure your OAuth app

When registering an OAuth application with the third-party service (e.g., Linear, GitHub, Slack), set the redirect / callback URL to:
This is the URL Gumstack uses to receive the authorization code after a user approves access.

Implement AuthProvider

Create a class that defines how to authenticate with your service:

Register with GumstackHost

Register your auth provider so Gumstack can use it:

Use in tools

Access the user’s credentials in your tools:

Credentials

Best for services that use API keys or tokens that users provide themselves. Users enter their credentials in the Gumstack UI, and Gumstack securely stores and provides them to your server. Define the fields you need in config.yaml:
Then access them in your tools:

None (Environment Variables)

Best for shared API keys that you (the developer) provide, or for public APIs that don’t require user-specific credentials. You set the credentials once in the Gumstack dashboard, and they’re available to all users.
Set your credentials in the Gumstack dashboard under Environment Variables, then access them in your tools:
With auth.type: none, get_credentials() is synchronous and reads directly from environment variables.

Reserved Environment Variables

Gumstack reserves certain environment variable prefixes for internal use. These will be rejected if you try to use them:
  • GUMLOOP_*
  • GUMSTACK_*