How resources work

Resources are the MCP servers that give agents something to do — without one connected, there are no tools to call, allow, or deny. Add resources from the catalog for common services, or connect any custom MCP server your organization runs.

From the catalog

The catalog includes pre-configured resources that work out of the box:

1. Navigate to Resources in the dashboard
2. Click Add Resource to open the catalog
3. Find a resource by search or by browsing a category, then click it to open its page
4. If it supports more than one way to authenticate, pick Use SecureAuth's app (the quickest option) or Bring your own app (paste your own OAuth client ID and secret — the form shows a redirect URI to register with the provider, then click Add). See Credential modes for the differences.
5. Resources that support only one option skip the choice: most show that single card and install when you click it, while bring-your-own-only resources take you straight to the credentials form

Available tools are discovered automatically. Users will be prompted to connect their accounts via OAuth when they first use the resource.

Custom resources

You can add any MCP server not in the catalog:

1. Navigate to Resources, click Add Resource, then + Custom server
2. Enter a display name, a slug, and the server URL for the MCP server. The slug is the short identifier used in policies (mcp.slug == "…") and in the single-MCP gateway URL.
3. Choose the authentication type:
   • None — no authentication required
   • OAuth2 — defaults to Automatic (DCR), which registers a client with the provider for you and needs no credentials. Switch to Use existing client credentials to supply your own client ID, secret, and scopes, plus either an OIDC issuer URL or manual endpoint URLs (an authorize URL as well as a token URL, for the default authorization-code grant)
   • API Key — add custom headers sent with every request
4. Click Add

The gateway connects to the server and discovers available tools automatically.

Custom servers stay editable: their detail page has an Edit button for fixing a typo'd URL or changing authentication in place. Catalog installs don't — apart from rotating BYO credentials, changing one means deleting it and adding it again.

Token endpoint authentication

By default the gateway auto-detects how to send the OAuth2 client credentials to the provider's token endpoint. Some providers only accept credentials in the POST body and reject HTTP Basic authentication — combined with single-use authorization codes, auto-detection can make the connect flow fail.

For dynamically registered (DCR) servers this is fully automatic: the gateway uses the method the provider reports during registration, and the setting cannot be overridden.

When you bring your own client — a custom server with existing credentials, or a catalog integration in BYO mode — set Token Endpoint Authentication explicitly if the provider is strict: client_secret_basic (client secret in the HTTP Basic header), client_secret_post (client secret in the POST body), or none (public client).

Resource details

Click any resource in the list to see its detail page:

• Available tools — every tool the MCP server exposes, with descriptions
• MCP Info — server URL, origin (catalog or custom), and — for custom servers — the authentication type
• Single-MCP gateway URL — the /gateway/mcp/{slug} endpoint that exposes only this resource's tools, with a copy button. Use it to scope an agent connection to one MCP
• Credentials — for resources installed in bring-your-own mode, a card to rotate the OAuth client ID and secret in place (details)
• Recent activity — audit events related to this resource

Next steps

• Policies — write rules that decide which agents can use these tools.
• Credential modes — how the gateway authenticates to catalog resources.
• Add resources — the guided walkthrough.