The TsgcWSAPIClient_MCP component can authenticate against an MCP server with an OAuth2 bearer token. When MCPOptions.AuthenticationOptions.OAuth2.Enabled is set, the client obtains an access token through the OAuth2 client and sends an Authorization: Bearer <token> header on every MCP HTTP request.
The default grant is the Identity Assertion Authorization Grant, which propagates the user identity across security domains without an interactive login. You can select any other supported grant through the GrantType property.
To let the client discover the authorization server, register itself and log the user in automatically, as defined by the MCP authorization specification, use MCPOptions.Authorization instead.
OAuth2 authentication takes precedence over ApiKey. When OAuth2.Enabled is True, the client sends the bearer token and ignores the API key, even if ApiKey.Enabled is also set.
The token is cached after it is first obtained and reused on subsequent requests until it is close to expiry, at which point the client refreshes it automatically. This avoids a round-trip to the authorization server on every MCP call.
The MCPOptions.AuthenticationOptions.OAuth2 object exposes the following properties.
| Property | Description |
|---|---|
| Enabled | When True, the client obtains a bearer token through OAuth2 and sends it on every MCP HTTP request. Takes precedence over ApiKey. |
| TokenURL | The token endpoint of the resource authorization server where the access token is obtained. |
| ClientId | The client identifier used to authenticate at the resource authorization server. |
| ClientSecret | The client secret used to authenticate at the resource authorization server. |
| Scope | The scope requested for the access token. |
| GrantType | The OAuth2 grant used to obtain the token. Default auth2IdentityAssertion. |
| IdentityAssertionOptions | Settings for the Identity Assertion grant (SubjectToken, Audience, RequestingPartyTokenURL, and the rest). These mirror the fields of the OAuth2 client. See the Identity Assertion Authorization Grant topic. |
The following snippet configures the MCP client to authenticate with the Identity Assertion grant against an MCP server URL, then calls Initialize to open the session.
MCP.MCPOptions.HttpOptions.URL := 'https://mcp.partner.com/mcp';
MCP.MCPOptions.Transport := aimcptrHttpStreamable;
MCP.MCPOptions.AuthenticationOptions.OAuth2.Enabled := True;
MCP.MCPOptions.AuthenticationOptions.OAuth2.GrantType := auth2IdentityAssertion;
MCP.MCPOptions.AuthenticationOptions.OAuth2.TokenURL := 'https://auth.partner.com/oauth2/token';
MCP.MCPOptions.AuthenticationOptions.OAuth2.ClientId := 'your-client-id';
MCP.MCPOptions.AuthenticationOptions.OAuth2.ClientSecret := 'your-client-secret';
MCP.MCPOptions.AuthenticationOptions.OAuth2.Scope := 'mcp.read mcp.write';
MCP.MCPOptions.AuthenticationOptions.OAuth2.IdentityAssertionOptions.RequestingPartyTokenURL := 'https://idp.example.com/oauth2/token';
MCP.MCPOptions.AuthenticationOptions.OAuth2.IdentityAssertionOptions.SubjectToken := 'the-users-existing-access-token';
MCP.MCPOptions.AuthenticationOptions.OAuth2.IdentityAssertionOptions.Audience := 'https://mcp.partner.com';
MCP.Initialize;