Skip to main content
Customers can register an OAuth 2.0 (OAuth) application in their enterprise Identity Provider (IdP) and enable Glean to accept those IdP-issued access tokens for Client API calls. Glean validates and enforces permissions for user-scoped tokens; token lifecycle (issuance, expiry, refresh) is governed by your IdP.
OAuth authentication is only supported for the Client API and MCP Remote Servers. Indexing API operations require Glean-issued tokens and do not accept OAuth.

​
When to choose IdP-based OAuth (REST)

  • You already operate enterprise OAuth in your IdP and want to reuse those tokens for Client API access.

​
High-level steps

  1. Register an OAuth client in your IdP using Authorization Code; add Proof Key for Code Exchange (PKCE) for public/native clients.
  2. In Glean Admin, enable OAuth token acceptance for the Client API and register the allowed client_id values and issuer configuration.
  3. Your application runs the Authorization Code flow against your IdP and obtains an access token.
  4. Your application calls the Glean Client API, passing the bearer token in the Authorization header and includes the header X-Glean-Auth-Type: OAuth.

​
Token characteristics

  • User-scoped; permissions are enforced by Glean at request time.
  • Validation includes issuer and client_id (and optional audience if configured by your admin).
  • Expiry and refresh are controlled by your IdP.

​
Common pitfalls and troubleshooting

  • 401/403 due to OAuth not enabled in Glean or missing X-Glean-Auth-Type header.
  • Mismatch between registered client_id/issuer in Glean Admin and the token presented.
  • IdP-side assignments/policies preventing user token issuance.
  • Attempting to call the Indexing API with OAuth tokens.

​
MCP note

MCP Remote Servers typically rely on the Glean OAuth Authorization Server path with Dynamic Client Registration (DCR). Do not attempt to wire MCP hosts directly to IdP-based REST OAuth unless your host’s guidance explicitly supports that model.

​
IdP setup references

Use your IdP’s standard application registration and policy configuration. We recommend OpenID Connect (OIDC).

​
Canonical IdP references

⌘I