# Authentication {#authentication}


Elova MCP uses OAuth. The supported clients start the browser flow from the server URL. You approve that request in Elova. There is no separate "enable AI access" step and no API key.

The published resource is `https://mcp.elova.dev/mcp`. The published issuer is `https://auth.elova.dev/realms/elova`. Protected-resource metadata advertises exactly two scopes: `workspaces:read` and `n8n:read`. Bearer tokens are accepted in the `Authorization` header only. A browser cookie is not an MCP credential.


## Scopes {#scopes}


| Scope | Approval label | Tools |
| --- | --- | --- |
| `workspaces:read` | Read workspace details | `get_many_workspaces`, `get_workspace` |
| `n8n:read` | Read n8n data | The other seven tools |

You can approve a subset of the scopes the client requested. You cannot add a scope the client did not request. Identity scopes and offline access are not part of this connection.

A tool call without its scope is rejected before the read. The challenge names the missing scope.


## Approval {#approval}


The connection page is titled **Connect to Elova**. It shows the client name. If the client registered itself, the page says **This application supplied its name.**

Approval requires a password sign-in that is still fresh. The normal bound is five minutes. The OAuth request can require a shorter bound. If the page asks you to sign in again, do that before allowing access.

You must:

- select 1–50 current member workspaces
- select at least one requested read permission
- choose an expiry
- check **I approve sharing the selected workspace data with this client**

The expiry choices are **1 day**, **7 days**, and **30 days**, when those durations still fit inside the 30-day maximum. The page selects 7 days when that option is available. If none of those durations fit, the page offers the maximum available duration instead.

The allow button reads **Allow {client name} access**. **Deny** returns a cancellation to the client. Opening the page does not approve the client.

The page can offer up to 200 eligible workspaces. One approval can include at most 50. An account can have at most 100 active approvals. Replacing the approval for the same client is allowed at that cap. A new client is not.

Approving again for the same client replaces that client's approval. The old connection cannot adopt the new approval. Complete the new browser sign-in if you want the client to use the replacement.


## What stays valid {#what-stays-valid}


An access token lasts at most five minutes. The client refreshes it while the approval and sign-in session are still valid. A refresh token cannot be reused.

The identity configuration shipped with Elova ends an idle sign-in session after 30 minutes and ends every sign-in session after 30 days. Your selected approval expiry can end access sooner. When refresh fails, start sign-in from the client again. Do not expect an old approval code to still work.

These actions do **not** remove a connection:

- closing the browser
- signing out of Elova in the browser

These actions invalidate earlier MCP approvals:

- removing the approval in **AI access**
- completing a password reset, or a forced sign-out, when that action changes the account authorization version
- changing your login email, which signs you out and disconnects AI clients

Losing membership in one workspace removes that workspace from later reads. Other approved workspaces remain readable while you still belong to them. A platform administrator role does not grant workspace access.


## Review and remove {#review-and-remove}


1. Open **Your account** from the account email in the sidebar.
2. Open the **AI access** card.
3. Copy the **MCP server address** if you need to reconnect.
4. Under **Connected clients**, review the workspaces, read permissions, and expiry.
5. Select **Remove access**, then **Confirm removal**.

Removal requires a password sign-in from the last five minutes. If Elova says to sign in again, do that and retry. Removal stops future Elova reads. It cannot recall data the client already stored.

If the card says **AI access is not enabled on this Elova installation yet**, this installation is not offering MCP. Connecting a client will not succeed until an operator enables it.