Learning level
25/100
OAuth, Authentication & Organization Authorization
VauPrime MCP · 21–40 · Authentication & AccessGuide type
Security
Audience
Users & builders
Sections
4
OAuth, Authentication & Organization Authorization
MCP guideLearn how VauPrime MCP verifies the connected account and separately checks access to each organization before reading business data.
What this guide covers
OAuth protection
Token verification
Organization authorization
User-scoped database access
Quick facts
ProductVauPrime MCP
ProtocolModel Context Protocol
TransportStreamable HTTP
AccessRead-only tools
Purpose-limited access: VauPrime MCP is designed for authorized, read-only accounting context and minimized structured responses.
01
OAuth protection
Protected tools use VauPrime Supabase OAuth 2.1 with the profile scope. The connected client sends the bearer token to the MCP endpoint.
02
Token verification
The server verifies the bearer token through VauPrime/Supabase Auth and resolves the verified user id before any user-specific business query is performed.
03
Organization authorization
Authentication identifies the account; organization authorization separately verifies that the account can access the requested organization before scoped reads execute.
04
User-scoped database access
User-facing MCP data access uses the same user token plus explicit user and organization scoping. The MCP project does not rely on a Supabase service_role key for these reads.
Production endpoint
https://mcp.vauprime.com/mcp