OAuth sign-in for the SD Elements MCP server
Starting with SD Elements 10.1, AI agents such as Claude, VS Code (GitHub Copilot) and ChatGPT can connect to the SD Elements MCP server by signing in to SD Elements in the browser. Your users sign in the way they always do, including through single sign-on, and no longer need to copy an API key into their AI agent.
This guide is for SD Elements administrators at SaaS customers. It explains what OAuth changes, how to have it turned on, and what to do once it is on.
Availability
-
OAuth is available for SD Elements SaaS customers from release 10.1.
-
It is off by default. Nothing changes for you until you ask for it.
-
Until OAuth is turned on, your users keep connecting to the MCP server with API keys, as they do today.
| In a later release, OAuth will become available to all customers by default, and administrators will get a setting in SD Elements to turn it on or off. Customers who prefer not to have it will be able to keep it off. |
Why use OAuth
-
No API keys in AI agents. Users sign in through SD Elements, so there is no long-lived key stored in each AI agent.
-
Your normal sign-in applies. Users sign in through your usual login and single sign-on provider. The AI agent never sees their password.
-
The AI agent has exactly the user’s permissions. It cannot see or change anything the user could not, and every action is recorded against the user.
What changes when OAuth is on
| Area | Change |
|---|---|
API keys |
The MCP server no longer accepts API keys. Every user must sign in with OAuth. |
Who has access |
Every global role that can create API keys is given the Allow MCP server access permission. Users in those roles can connect straight away. |
AI clients |
Only clients that support OAuth sign-in can connect: Claude, VS Code (GitHub Copilot) and ChatGPT/Codex. |
| Cursor cannot connect with OAuth. If some of your users work in Cursor, discuss this with your CSM or Tech Support before you ask for OAuth. |
Before you ask for OAuth
-
Your users know that API keys will stop working with the MCP server.
-
You know which global roles can create API keys, because those roles get MCP access by default.
-
Your users work in a supported AI client: Claude, VS Code (GitHub Copilot) or ChatGPT/Codex.
How to have OAuth turned on
-
Contact your CSM or Tech Support and ask for OAuth for the MCP server.
-
Our team turns on OAuth for your SD Elements environment.
-
We let you know once OAuth is on.
You do not need to change any server settings yourself.
After OAuth is on
Review who has access
Users need the Allow MCP server access global permission. You can find it in the MCP section when you edit a global role.
Because this permission is added to every role that can already create API keys, review your global roles and remove it from any role that should not use AI agents.
Tell VS Code users to clear old sign-ins
VS Code (GitHub Copilot) can keep an old connection to the MCP server and reuse it after OAuth is turned on. A user can then appear to be connected with their old setup, or as a different user. Ask anyone who connected VS Code to the MCP server before OAuth was on to clear it once:
| This is due to a current bug in VS Code (as of October 9, 2026). It is not caused by SD Elements, which rejects API keys once OAuth is on. |
-
Open the Command Palette: Ctrl+Shift+P on Windows and Linux, Cmd+Shift+P on macOS.
-
Run Authentication: Remove Dynamic Authentication Providers.
-
Select the entry for your SD Elements host and confirm.
-
Restart the server in MCP Servers and sign in again.
Claude and ChatGPT/Codex are not affected.