---
title: Create an OAuth client in Elastic Agent Builder
description: Register an OAuth client in Agent Builder to get the credentials and server URL needed to connect an MCP host over OAuth.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/create-oauth-client
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
---

# Create an OAuth client in Elastic Agent Builder
Register a new OAuth client in Elastic Agent Builder to generate the credentials that an MCP host, such as Claude Desktop, needs to connect over OAuth 2.1. This is a one-time step you complete before connecting any host to Elastic Agent Builder.
Each OAuth client is scoped to a single Serverless project. Creating a client gives you a client ID and the MCP server URL for that project. For confidential clients, you also get a client secret that is shown only once and can't be retrieved later.
<note>
  In the Kibana UI, OAuth clients are labeled **MCP clients**. The button and menu labels in these steps, such as **Add MCP client**, refer to the OAuth client you're creating.
</note>


## Before you begin

Before you create an OAuth client:
- Familiarize yourself with the following concepts:
  - [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/explore-analyze/ai-features/elastic-agent-builder), which provides the tools and agents you'll access.
- The [Elastic Agent Builder MCP server](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/explore-analyze/ai-features/agent-builder/mcp-server), which exposes those tools to external MCP hosts, and its [authentication methods](/elastic/docs-content/pull/7385/explore-analyze/ai-features/agent-builder/mcp-server#mcp-server-authentication). OAuth is one of two ways to authenticate to the MCP server, so confirm it fits your use case.
- [MCP clients and the OAuth flow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/oauth-clients).
- Make sure you have **Read** access to the Elastic Agent Builder Kibana feature, which grants access to the MCP client management UI. To learn more, refer to [Permissions](/elastic/docs-content/pull/7385/explore-analyze/ai-features/agent-builder/permissions#kib-privileges).


## Create the client

<stepper>
  <step title="Open the MCP client management page">
    1. Find **Agents** in the navigation menu. You can also search for **Agent Builder** in the [global search bar](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/explore-analyze/find-and-organize/find-apps-and-objects).
    2. Click **Manage components** at the bottom of the left sidebar, then select **Tools**.
    3. On the tools library page, click **Manage MCP**, and then select **Manage MCP clients (OAuth)**.
    4. Click **Add MCP client**.
    You can also get to this page from **Admin and settings** → **Application connections** → **Manage MCP clients**.
  </step>

  <step title="Name the client">
    Enter a **Client name**. The name is visible to users during the authorization flow, so use something that clearly identifies the application (for example, `Claude Desktop — Engineering`).
  </step>

  <step title="Select a client logo">
    Optionally set a **Client logo** to identify the application in the list. Use **Select logo** to choose from provided options, or select **Upload logo** to use a custom image.Selecting a logo is cosmetic, and does not pre-configure any settings.
  </step>

  <step title="Set the redirect URI">
    The redirect URI tells the authorization server where to return the user after they authorize the connection. Select the redirect URI type:
    - **Local** — For applications running on your local machine. The redirect URIs are pre-populated with `http://localhost/callback` and `http://localhost/oauth/callback`. Replace or supplement these values to match your Agent's expected callback URL. The authorization server accepts any localhost port, but the path must match exactly. Common values:
      - Claude Desktop (mcp-remote): `http://localhost/oauth/callback`
    - Claude Code CLI (native HTTP): `http://localhost/callback`
    - **Remote** — For hosted or cloud-based applications. Enter a single `https://` URL. Plain HTTP is not accepted.
    For local clients that need more than one redirect URI, click **Add local URL** to add additional URLs.
  </step>

  <step title="Optional: Generate a client secret">
    You can optionally select **Generate confidential MCP client** to add a client secret for extra security. This is most useful when your MCP host can store a secret securely, such as a server-side service.The client secret is displayed after you create the client. The secret is only displayed once and can't be retrieved later.
  </step>

  <step title="Save the client">
    Click **Create client**. The **Copy server details for [client name]** dialog displays the values your MCP host (AI agent) needs to authenticate:
    - **Client ID**: The identifier for this client.
    - **MCP server URL**: The endpoint your MCP host uses to reach this project's Elastic Agent Builder tools.
    - **Client secret**: Appears for confidential clients only. This value is displayed only once and can't be retrieved later, so copy or download it before you close the dialog.
    You'll use these values to [connect an MCP host](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/connect-mcp-host).The client ID and MCP server URL can be retrieved at any time from the **MCP clients** page.
  </step>
</stepper>

<note>
  OAuth clients can also be created through the Kibana API. To create a client through the API, you must use an Elastic Cloud API key with [Cloud, Elasticsearch, and Kibana API access](/elastic/docs-content/pull/7385/deploy-manage/api-keys/elastic-cloud-api-keys#project-access). Creating a client with an API key created directly in Elasticsearch is not supported.Clients created through the API are not visible in the Agent Builder client list in Kibana, because they are not owned by a specific user. They appear only in the organization-level [Application connections](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/manage-app-connections) view in the Elastic Cloud Console.
</note>


## Next steps

Now that you have the client ID and MCP server URL for your OAuth client, [configure your MCP host to use them](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/connect-mcp-host).
You can also share these values so that other people connect the same client in their own MCP hosts. Each person authorizes access separately and gets their own connection.

## Related pages

- [OAuth for MCP clients](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/oauth-clients)
- [Revoke an OAuth client or connection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/revoke-oauth-client)
- [Manage application connections](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7385/deploy-manage/app-connections/manage-app-connections)