Remote MCP servers usually sit behind authentication, because they reach into your real accounts and data. Claude Code supports two ways to prove who you are: OAuth and header-based auth.
OAuth
Many hosted servers use OAuth, the same sign-in flow you get on the web. You add the server as usual:
claude mcp add --transport http notion https://mcp.notion.com/mcp
Then start Claude Code and open the /mcp menu. From there you can trigger the login for a server that needs it, which sends you through the provider's sign-in and consent screen in your browser. Once you approve, Claude Code holds the connection and the server's tools become usable. You don't paste a token by hand.
Header-based auth
Some servers instead expect a token in a request header, such as an API key or bearer token. In that case you supply the header value when you connect, rather than going through a browser flow. This suits servers that issue you a long-lived key.
Checking and re-authenticating
Use /mcp in a session to see each server's status. If a server shows as unauthenticated or its login has expired, /mcp is where you sign in again. A server that connects but returns permission errors is usually a sign the auth step didn't finish or the token lacks the right access.
Keep tokens safe
When a server needs a key rather than OAuth, avoid hardcoding it in shared config. Pass it through an environment variable so the secret stays out of git and out of .mcp.json. The next article shows exactly how environment variable expansion works in MCP config.
Comments
Be the first to comment.