OAuth for MCP: why your AI should never see your password
Published November 4, 2026
When you add a remote MCP server to Claude or ChatGPT, the app opens a sign-in page and you approve access there. The AI app gets a token that only works for that server and can be revoked, not your password. The server, in turn, signs in to Gmail or GitHub with their own OAuth or with a key it stores encrypted. At no point does the model see a password or key.
The two sign-ins
There are two separate connections. First, the AI app signs in to the MCP server: the MCP specification uses OAuth 2.1 for this, with a consent screen that names the app. Second, the MCP server signs in to each service, through that service’s own OAuth (Google, Slack, GitHub) or with an API key or app password you paste into the server’s own page, never into the chat.
What the AI app receives
- An access token for the MCP server, valid for a limited time and refreshed in the background.
- Tool names and results. Not your Google password, not your API keys.
How to take access back
Revoke the AI app in the MCP server’s dashboard, and its token stops working at once. Remove an account, and the server deletes its stored keys. You can also revoke the server’s access in each service’s own security settings.
Red flags
Manyplug signs AI apps in with OAuth 2.1, connects services on its own pages, encrypts each account’s keys separately, and never asks for a key in the chat.
- A chat that asks you to paste a password or API key into the conversation.
- Keys stored in a plain-text config file that other programs can read.
- No way to see which apps are connected or to disconnect them.