Authentication configurations | Admin guide

This guide explains how system administrators can create and manage authentication configurations in Theta Assist.

Use authentication configurations when a connector or MCP server needs to sign in to an external service such as Microsoft, Google, Dropbox, or another OAuth provider.

What authentication configurations are

Authentication configurations store the connection details Theta Assist needs to authenticate with an external service.

They are created once by an admin and then reused by connectors or MCP servers that need that provider.

For example, you might create one Microsoft authentication configuration and use it for:

standard Microsoft connectors
the M365 Tools MCP server
other Microsoft-based integrations

When you need one

You need an authentication configuration when a connector or MCP server requires sign-in or API access to another platform.

This commonly applies to:

Microsoft 365
Google Workspace
Dropbox
custom OAuth-based services
services that use a static API key

If a connector or MCP server is public and does not require authentication, you may not need an authentication configuration.

Before you start

Before you create an authentication configuration, make sure:

you are a system administrator in Theta Assist
you have admin access to the external provider, if required
you know which connector or MCP server will use this configuration
you have the required client ID, client secret, URLs, scopes, or API key ready

Create an authentication configuration

Go to Admin > Tools > Auth Configurations.
Click + Add Auth.
Enter a clear Configuration name, such as Microsoft 365 production.
Select the Provider.
Optionally add a Description.
Enter the required authentication details for your chosen method.
Click Save.

After saving, you can attach the authentication configuration to a connector or MCP server that supports that provider.

Authentication options

Standard OAuth 2.0

Use this for most common provider integrations.

You will usually need:

Authorization URL
Token URL
Client ID
Client secret
Scopes
Tenant ID for Microsoft, where required

Discovery-based OAuth

Some providers support OAuth discovery so Theta Assist can find the required endpoints automatically.

For this option:

enable Use OAuth Discovery
enter the Discovery endpoint
use manual endpoint override if your provider needs custom values

Dynamic client registration

Some providers support dynamic client registration.

For this option:

enable Supports Dynamic Registration
enter the Registration endpoint

The system can then register and cache client credentials automatically where supported.

Static API key

Some services use a static API key instead of OAuth.

For this option:

leave the OAuth fields empty
enter the Static Authorization value

Use this only when the service supports API key authentication.

Provider-specific notes

Microsoft

Microsoft integrations usually require:

a Microsoft Entra ID app registration
delegated Microsoft Graph permissions
tenant ID, client ID, and client secret
admin consent for the required scopes

If you already use Microsoft connectors, you may be able to reuse the same app registration and extend its permissions for broader MCP use.

For Microsoft-specific setup detail, see M365 Tools MCP server | Admin guide.

Google

Google integrations usually require a Google Cloud OAuth client, the correct redirect settings, and the required scopes for the services you want to use.

Dropbox

Dropbox integrations usually require a Dropbox app, client credentials, and the correct scopes for file access.

Other providers

For other providers, use the values supplied by that service for OAuth or API key authentication.

Security and management notes

Use clear names so admins can tell production, test, and pilot configurations apart.
Only grant the scopes needed for the intended use.
Store and manage client secrets carefully.
Review configurations regularly, especially if secrets expire.
Where possible, test new configurations with a limited pilot before wider rollout.

Troubleshooting

The provider will not authenticate

Check that:

the client ID and client secret are correct
the authorization and token URLs are correct
the redirect settings match the provider configuration
the required scopes have been added
admin consent has been granted where required

The configuration saves but does not work

Check whether the connector or MCP server is using the correct authentication configuration.

Also confirm that the provider and scopes match the tool you are trying to enable.

Users are prompted unexpectedly

This can happen when tokens expire, consent changes, or the configuration has been updated.

Ask the user to authenticate again and confirm the provider settings are still valid.