envoy.com

In the Dev Dashboard, create or open an integration for your company, then use the Client API Key option described in Envoy's private-app auth guide. Envoy documents this as a long-lived token for the newer https://api.envoy.com/v1 APIs, sent in the X-API-Key header.

For a private app used only within your company, first create an API user in the employee directory, assign that user the Global Admin role, and disable Show employee as a host on the Visitors Kiosk as described in Envoy's guide. Then create an integration in the Dev Dashboard, add the scopes you need, save it, and copy the client id and client secret from Envoy API Credentials. Use those together with the API user's email/password to obtain OAuth access and refresh tokens from https://api.envoy.com/oauth2/token with grant_type=password.

Create or open your app in the Dev Dashboard, configure the required API scopes, and copy the app's client_id and client_secret. For listed/public installs, configure setup steps and webhooks as described in Envoy's docs so Envoy can provide an install token and install_id, which you exchange at https://api.envoy.com/oauth2/token with grant_type=plugin_install.

For an app installed outside the Envoy dashboard, open the app in the Dev Dashboard, enable Externally using OAuth2, add your redirect URL, and save. Then direct the user to Envoy's authorization URL https://app.envoy.com/a/auth/v0/authorize with your client_id, configured redirect_uri, and requested scopes; exchange the returned authorization code at https://app.envoy.com/a/auth/v0/token using your client_id and client_secret to get bearer and refresh tokens.

Use an MCP client that supports OAuth and connect it to https://mcp.envoy.com/mcp. Envoy documents that you add the server URL in the client and complete the OAuth authentication flow when prompted. The MCP client handles the OAuth registration/discovery flow automatically; you just approve access in the browser.