MCP authentication
Model Context Protocol (MCP) clients authenticate to Databricks to call tools. When a tool accesses an external service, a separate credential determines which provider account it uses.
This page explains supported authentication methods for Unity Gateway and MCP servers on Databricks Apps. Use the setup guides to configure authentication for your client, agent, or MCP server. For IP access lists, network policies, and private connectivity, see MCP networking.
The following diagram shows the two authentication steps for an external MCP accessed through Unity Gateway.
- Inbound authentication: The client sends a Databricks token that identifies a user or Databricks service principal.
- Outbound authentication: Unity Gateway sends the external provider's token to the MCP. The authentication method configured in the Unity Catalog connection determines whether it uses each user's provider account or a shared account.
Find your setup guide
Choose a guide for the prerequisites, configuration steps, and code for your use case.
Guide | What it covers |
|---|---|
Add MCPs, authorize provider access, and call tools. Start with the coding agent quickstart if your agent isn't connected to Databricks yet. | |
Configure an OAuth client and add the MCP connector. For another business client, see Other MCP clients. | |
Your app serves multiple users. Use each user's token, check their provider sign-in, and call tools with their permissions. | |
Build or test an agent locally. Sign in with the CLI, load MCP tools, and run the agent with your chosen framework. | |
Deploy an MCP server on Databricks Apps, enable user authorization, and configure an HTTP connection to your API. | |
Configure OAuth M2M credentials, then use them with the Python MCP client. | |
Register the server, choose its authentication method, and test a tool. |
Use MCP tools with Consumer access
Users can call MCP tools through Unity Gateway from coding agents, custom apps, and business clients with the Consumer access entitlement. They don't need the Workspace access entitlement, which grants access to workspace authoring tools such as notebooks and jobs.
An admin grants Consumer access and permission to call the MCP. For MCPs that use per-user OAuth, users authorize their provider account through the MCP sign-in page.
Consumer access supports using MCP tools. Managing MCPs in the Unity Gateway UI requires Workspace access. See Consumer access capabilities.
Supported inbound authentication
The client sends a Databricks token when it calls an MCP through Unity Gateway or on Databricks Apps. This token identifies the Databricks user or Databricks service principal making the request.
Your use case | Authentication to use |
|---|---|
A person signs in from a coding agent or business client. | OAuth user-to-machine (U2M) calls the MCP as the signed-in user. |
An unattended agent or service runs without a user. | OAuth machine-to-machine (M2M) calls the MCP as a service principal. |
Your app or workload already has a token from an identity provider. | OAuth token federation exchanges that token for a Databricks OAuth token for the mapped user or service principal. |
An existing integration uses a personal access token. | Personal access token (PAT) calls the MCP as the token's owner. Supported through Unity Gateway. Not supported for MCP servers on Databricks Apps. |
Supported outbound authentication
Outbound authentication determines which credential an external MCP or backend receives. Unity Gateway manages credentials through Unity Catalog connections. An MCP server on Databricks Apps can use a connection or implement its own backend authentication.
Through Unity Catalog connections
Unity Gateway authenticates to the external MCP with the provider token configured or obtained through its Unity Catalog connection.
Unity Gateway supports all five authentication methods available for Unity Catalog HTTP connections. The external MCP must support the selected method:
Supported method | When to use | Identity at the external MCP |
|---|---|---|
All callers share one token to access the MCP. | The account represented by the shared token. | |
The MCP supports OAuth client credentials for a shared service identity. | The service identity configured in the connection. | |
The MCP requires user sign-in, and all callers should use one shared provider account. | The provider account authorized for the connection. | |
The MCP supports automatic OAuth client registration and per-user sign-in. | The provider account that the caller authorized. | |
Each user needs access through their own provider account, using a configured OAuth client. | The provider account that the caller authorized. |
Databricks-provided MCPs
For data MCPs such as Databricks SQL, the caller's Databricks identity determines access to the underlying data. MCPs for external services, such as GitHub, use provider authentication as described in Through Unity Catalog connections. See Databricks-provided MCPs for each server's requirements.
Agents and MCP servers on Databricks Apps
An agent or MCP server on Databricks Apps can call Databricks using app authorization as the app's service principal, or user authorization as the current user.
The destination determines how to authenticate the outbound call:
- Databricks APIs or other MCPs through Unity Gateway: Use app authorization to call as the app, or user authorization to call as the current user.
- External REST APIs through the HTTP connection proxy: The proxy authenticates to the external API using the selected connection method. To call as each user, combine Apps user authorization with per-user OAuth on the connection.
- External APIs or MCPs called directly: Implement the authentication flow supported by that service in your server.
For setup, required scopes, and code, see Configure agent authentication and Expose a REST API as MCP tools.