Loading

Create or edit an OAuth client in Elastic Agent Builder

Register a new OAuth client in Elastic Agent Builder to generate the credentials that an MCP host, such as Claude Desktop, needs to connect over OAuth 2.1. This is a one-time step you complete before connecting any host to Elastic Agent Builder.

Each OAuth client is scoped to a single Serverless project. Creating a client gives you a client ID and the MCP server URL for that project. For confidential clients, you also get a client secret that is shown only once and can't be retrieved later.

Note

In the Kibana UI, OAuth clients are labeled MCP clients. The button and menu labels in these steps, such as Add MCP client, refer to the OAuth client you're creating.

You can also edit an existing client to change its name, logo, or redirect URIs without replacing its credentials.

Before you create an OAuth client:

  1. Open the MCP client management page

    1. Find Agents in the navigation menu. You can also search for Agent Builder in the global search bar.
    2. In the secondary navigation, select Tools.
    3. In the Tools workspace, click Manage all tools.
    4. In the Tools library workspace, click Manage MCP, and then select Manage MCP clients (OAuth).
    5. Click Add MCP client.

    You can also get to this page by searching for Application connections in the global search bar, then selecting Manage MCP clients.

  2. Name the client

    Enter a Client name with no more than 128 characters. The name is visible to users during the authorization flow, so use something that clearly identifies the application (for example, Claude Desktop — Engineering).

  3. Optionally set a Client logo to identify the application in the list. Use Select logo to choose from provided options, or select Upload logo to use a PNG, JPEG, or GIF of up to 192 KB.

    Selecting a logo is cosmetic, and does not pre-configure any settings.

  4. Set the redirect URI

    The redirect URI tells the authorization server where to return the user after they authorize the connection. Select the redirect URI type:

    • Local — For applications running on your local machine. The redirect URIs are pre-populated with http://localhost/callback and http://localhost/oauth/callback. Replace or supplement these values to match your Agent's expected callback URL. The authorization server accepts any localhost port, but the path must match exactly.

      Common values:

      • Claude desktop app: http://localhost/oauth/callback
      • Claude Code CLI (native HTTP): http://localhost/callback
      • Cursor (desktop): http://localhost/callback (Cursor uses port 8787, which is accepted automatically)

    • Remote — For hosted or cloud-based applications. Enter a single https:// URL. Plain HTTP is not accepted.

      Common values:

      • claude.ai: https://claude.ai/api/mcp/auth_callback

      • Cursor (web/agents): https://www.cursor.com/agents/mcp/oauth/callback

      • ChatGPT: https://chatgpt.com/connector/oauth/{callback_id}

        Warning

        The ChatGPT callback URL is unique to each app. You must start the app creation flow first to get this URL, then return here to add it to your OAuth client.

    For local clients that need more than one redirect URI, click Add local URL to add up to 20 URLs. Each local or remote redirect URI can contain up to 2,048 characters.

  5. Optional: Generate a client secret

    You can optionally select Generate confidential MCP client to add a client secret for extra security. This is most useful when your MCP host can store a secret securely, such as a server-side service.

    The client secret is displayed after you create the client. The secret is only displayed once and can't be retrieved later.

  6. Save the client

    Click Create client. The Copy server details for [client name] dialog displays the values your MCP host (AI agent) needs to authenticate:

    • Client ID: The identifier for this client.
    • MCP server URL: The endpoint your MCP host uses to reach this project's Elastic Agent Builder tools.
    • Client secret: Appears for confidential clients only. This value is displayed only once and can't be retrieved later, so copy or download it before you close the dialog.

    You'll use these values to connect an MCP host.

    The client ID and MCP server URL can be retrieved at any time from the MCP clients page.

You can edit an active client's name, logo, and redirect URIs. You can't edit its client type, client ID, MCP server URL, or client secret. Revoked clients can't be edited.

To edit a client:

  1. Find Agents in the navigation menu. You can also search for Agent Builder in the global search bar.

  2. In the secondary navigation, select Tools.

  3. In the Tools workspace, click Manage all tools.

  4. In the Tools library workspace, click Manage MCP, and then select Manage MCP clients (OAuth).

  5. Find the client. Click Actions, and then click Edit.

  6. Edit any of the following fields:

    • Name
    • Client logo (optional): Select a provided logo, upload a custom logo, or remove the existing logo.
    • Redirect URI type: Select Local or Remote, then add, remove, or edit a redirect URI.

    The edited fields must meet the same requirements described in Create the client.

  7. Click Update.

Kibana returns you to the MCP clients page and confirms that the client was updated.

After creating a client, configure your MCP host with its client ID and MCP server URL.

You can also share these values so that other people connect the same client in their own MCP hosts. Each person authorizes access separately and gets their own connection.