Skip to main content
Use the quickstart first. This page explains the permission model when you need to configure or debug access.

​
The three parts

Creating a client does not grant it access. The authorizing account must have a role containing the requested privileges.

​
Scope-to-privilege mapping

Neuron prefixes an OAuth scope with OAUTH.Scope. and replaces colons with periods:
Built-in scope roots are:
Prefer specific leaf scopes. Granting OAUTH.Scope.MCP.Files can authorize the current and future operations below that root; it is not equivalent to read-only access.

​
OAuth discovery

Clients discover the OAuth configuration from the Neuron:
Use the endpoints and methods advertised by those documents. Current Neuron deployments can differ in enabled registration and authentication methods.

​
Credential handling

  • Let the MCP client complete OAuth and store its credentials.
  • Never put access tokens in URLs, prompts, documentation, or source control.
  • Give each automated client its own identity and role.
  • Separate read, write, and destructive permissions.
  • Disable the client or account when access should end.
Bearer-token configuration is useful for diagnostics or non-interactive deployments, but it should not replace an available OAuth login flow.