This page is for the person administering the Neuron. A client cannot complete OAuth setup unless the Neuron provides a client registration path and an account with the required permissions.
1. Select one endpoint
Start with a single endpoint and read-only access. For example:
Do not use /MCP; the Neuron exposes separate MCP servers.
2. Create a role
In Administration → Users and Roles → Roles, create a role for the client. A read-only Files role can contain:
Assign the role to the account that will authorize the client. Registration alone does not grant access.
3. Choose client registration
Use one of these approaches:
- Pre-provisioned static client ID: use a deployment-specific client registration that has already been configured and tested with Codex, including its redirect URI.
- Dynamic client registration (DCR): enable it only if your deployment has been configured and tested for it. The client registers during
codex mcp login.
Do not ask developers to obtain and paste access tokens as the normal setup. Their MCP client should perform the OAuth flow and store its own credentials.
Codex cannot sign in unless the Neuron provides a registered OAuth client or dynamic client registration. If neither is available, the operator must configure OAuth before the developer continues.
4. Give the developer a connection profile
Provide these values together:
Never include a client secret, access token, or refresh token in the profile.
5. Test the granted permissions
After the developer signs in:
- Confirm a read-only request succeeds.
- Confirm an ungranted write request is rejected.
- Check the Neuron event log for the request.
See MCP permissions when you need to design a different permission set. 
