MCP authentication

Authenticate your MCP client with a Makeform API key or an OAuth access token. Use an API key for a client that does not support Makeform’s OAuth flow.

Send a bearer token

Send the token in the Authorization header with each JSON-RPC request to https://mcp.makeform.ai:

Use an API key

Create a key in Settings → API keys. Keys created in the dashboard carry the makeform:mcp and makeform:api scopes.

The environment variable should contain your API key. A workspace-level key sees only forms in its workspace, and new forms are created in that workspace.

Use OAuth

MCP supports the authorization code flow with PKCE, a consent page, and refresh tokens. OAuth access tokens must be issued for the MCP server and include a client_id and both required scopes: email and profile.

Dynamic client registration is set up for the Claude and ChatGPT connector callbacks. Other clients should use an API key. OAuth tokens cannot be used as browser sessions or with the REST API. The OAuth flow does not use an openid scope or issue an ID token.

Each MCP tool declares its OAuth scopes as email and profile. The server’s OAuth protected-resource metadata is available at https://mcp.makeform.ai/.well-known/oauth-protected-resource.

Handle authentication errors

A missing token returns HTTP 401 with JSON-RPC error -32001 and data.name: "missing_api_key". A bad token returns HTTP 401 with the same error code and data.name: "invalid_token".

The response includes a WWW-Authenticate header with the OAuth resource metadata URL. Clients that support OAuth discovery can use it to start discovery. Users can revoke OAuth grants in Settings → Connected apps.

Tool errors return HTTP 200 with result.isError: true; content[0].text contains JSON with a jsonrpc_error object. Input schema failures start with MCP error -32602: Input validation error.