Permissions and security

Understand OAuth scopes, access boundaries, and write-action safety.

Autentique MCP uses OAuth 2.0 with PKCE. Authentication happens on Autentique pages, and the AI client receives only the authorization required for the connected account.

Requested permissions

The connector may request these scopes, depending on the available tools:

• user:read

• organizations:read

• documents:read

• documents:create

• documents:update

• folders:read

The authorization screen shows the requested permissions before access is granted.

Access boundaries

The connector can access only organizations, documents, folders, and actions available to the authenticated Autentique user. Connecting the MCP server does not grant additional Autentique permissions.

Each person should connect their own Autentique account. Do not share OAuth tokens or copy tokens into prompts, configuration files, tickets, or chat messages.

Write actions and costs

Some tools create or change data. Creating documents and using email, SMS, WhatsApp, or identity-verification methods may consume plan or API credits.

Review the tool arguments before approving a write action. Removing a signer is irreversible and is available only while the document and signer are still editable.

Use sandbox mode while developing or testing a workflow whenever possible.

Revoke access

You can revoke the connection from the API Access page in the Autentique dashboard. After revocation, the AI client must complete OAuth again before it can use Autentique.

Security recommendations

• Connect only from a trusted MCP client.

• Verify that the authorization page belongs to Autentique before signing in.

• Review requested scopes and tool confirmations.

• Keep write-action approval enabled unless the workflow is tightly controlled.

• Disable tools that are not required for the current workflow.

• Report unexpected tool behavior to Autentique support.

For general data-handling information, see the Autentique Privacy Policy.