Authentication

Elova MCP uses OAuth. The supported clients start the browser flow from the server URL. You approve that request in Elova. There is no separate "enable AI access" step and no API key.

The published resource is https://mcp.elova.dev/mcp. The published issuer is https://auth.elova.dev/realms/elova. Protected-resource metadata advertises exactly two scopes: workspaces:read and n8n:read. Bearer tokens are accepted in the Authorization header only. A browser cookie is not an MCP credential.

Scopes

You can approve a subset of the scopes the client requested. You cannot add a scope the client did not request. Identity scopes and offline access are not part of this connection.

A tool call without its scope is rejected before the read. The challenge names the missing scope.

Approval

The connection page is titled Connect to Elova. It shows the client name. If the client registered itself, the page says This application supplied its name.

Approval requires a password sign-in that is still fresh. The normal bound is five minutes. The OAuth request can require a shorter bound. If the page asks you to sign in again, do that before allowing access.

You must:

• select 1–50 current member workspaces
• select at least one requested read permission
• choose an expiry
• check I approve sharing the selected workspace data with this client

The expiry choices are 1 day, 7 days, and 30 days, when those durations still fit inside the 30-day maximum. The page selects 7 days when that option is available. If none of those durations fit, the page offers the maximum available duration instead.

The allow button reads Allow {client name} access. Deny returns a cancellation to the client. Opening the page does not approve the client.

The page can offer up to 200 eligible workspaces. One approval can include at most 50. An account can have at most 100 active approvals. Replacing the approval for the same client is allowed at that cap. A new client is not.

Approving again for the same client replaces that client's approval. The old connection cannot adopt the new approval. Complete the new browser sign-in if you want the client to use the replacement.

What stays valid

An access token lasts at most five minutes. The client refreshes it while the approval and sign-in session are still valid. A refresh token cannot be reused.

The identity configuration shipped with Elova ends an idle sign-in session after 30 minutes and ends every sign-in session after 30 days. Your selected approval expiry can end access sooner. When refresh fails, start sign-in from the client again. Do not expect an old approval code to still work.

These actions do not remove a connection:

• closing the browser
• signing out of Elova in the browser

These actions invalidate earlier MCP approvals:

• removing the approval in AI access
• completing a password reset, or a forced sign-out, when that action changes the account authorization version
• changing your login email, which signs you out and disconnects AI clients

Losing membership in one workspace removes that workspace from later reads. Other approved workspaces remain readable while you still belong to them. A platform administrator role does not grant workspace access.

Review and remove

1. Open Your account from the account email in the sidebar.
2. Open the AI access card.
3. Copy the MCP server address if you need to reconnect.
4. Under Connected clients, review the workspaces, read permissions, and expiry.
5. Select Remove access, then Confirm removal.

Removal requires a password sign-in from the last five minutes. If Elova says to sign in again, do that and retry. Removal stops future Elova reads. It cannot recall data the client already stored.

If the card says AI access is not enabled on this Elova installation yet, this installation is not offering MCP. Connecting a client will not succeed until an operator enables it.