Authentication

Moshi MCP supports hosted OAuth and local API-key authentication. Use hosted OAuth unless you must run the server locally.

Hosted OAuth

Add https://mcp.moshi.ai/mcp as a remote HTTP MCP server. The server publishes OAuth discovery metadata. Your MCP client opens Moshi for sign-in and consent. During consent, select the organization that the client can use. Moshi binds the resulting connection to that organization. OAuth access tokens travel in the HTTP authorization header. Do not copy an OAuth access token into a client configuration file.

Local API key

Use the npm package when you need a local standard-input server. You need a Moshi API key issued for your organization.

Claude Desktop

{
  "mcpServers": {
    "moshi": {
      "command": "npx",
      "args": ["-y", "moshi-mcp"],
      "env": {
        "MOSHI_API_KEY": "your-api-key",
        "MOSHI_ORGANIZATION_ID": "your-organization-id"
      }
    }
  }
}

Keep the key in the client secret store when the client provides one. Do not commit the key to source control.

HTTP headers

Direct HTTP clients send credentials in this form:

Authorization: Bearer <credential>

The credential can be an OAuth access token or a Moshi API key. The hosted OAuth path sets organization scope from consent.

Authentication errors

Reconnect the server when the client reports an expired or rejected OAuth session. Check the API key value when a local connection returns 401. Confirm organization access when authentication succeeds but tools cannot read data. See Organization scope for binding rules.

​Hosted OAuth

​Local API key

​HTTP headers

​Authentication errors

Hosted OAuth

Local API key

HTTP headers

Authentication errors