To register a client directly with one of Informatica’s internal authorization servers, add an OAuth client. Adding an OAuth client creates the client and registers it with the selected Informatica OAuth server.
To use direct client registration, your organization must have access to AI Agent Engineering.
You can view information about the Informatica OAuth servers and add OAuth clients on the MCP Server Authorization page. You can access this page through the Configuration option in the left navigation menu.
The following image shows the MCP Server Authorization page:
Informatica OAuth servers
The Informatica OAuth servers manage permissions and access delegation for the OAuth clients in your organization. You can view OAuth server information on the MCP Server Authorization page.
The following image shows the Informatica OAuth server information on the MCP Server Authorization page:
The following information is displayed for each OAuth server:
Grant type
The grant type displays the protocol flow that the client uses to request and obtain an access token. Informatica provides two OAuth servers: one that supports the Authorization Code flow and one that supports the Client Credentials flow.
Request method
Request method that the application client must use to make token requests. The Informatica OAuth servers support the POST method.
Authorization Endpoint
The authorization endpoint URL. Hover over this field to view the URL, and click the copy button to copy it. Applies only to the Authorization Code server.
Token Endpoint
The token endpoint URL. Hover over this field to view the URL, and click the copy button to copy it.
The page also lists the OAuth clients associated with each server. Click the down arrow to the left of the server name to display them.
Each client registers with an OAuth server to establish its identity and receive a unique client ID and, if applicable, client secret. This enables your AI agents to access an Informatica MCP server without having access to your IDMC credentials.
OAuth clients
Create and register an OAuth client to allow your AI agent to access Informatica's MCP servers without having access to your IDMC user credentials.
Create and update OAuth clients on the MCP Server Authorization page. The following image shows where to create and update OAuth clients:
The following table lists the actions you can perform based on the OAuth server's grant type:
Use the Authorization Code flow for stronger security in human-in-the-loop uses cases. The Authorization Code server requires a human user to grant permission.
When you register a client with the Authorization Code server, you specify whether the client can confidentially store secrets, provide one or more redirect URIs, choose the client scopes, and select the applicable MCP servers, tools, and resources. The registration process generates a client ID and, if the client is confidential, a client secret.
When an AI agent requests access to an MCP server, the user must log in to grant permission. The OAuth server then issues a temporary authorization code. The AI agent sends the code back to the OAuth server along with a PKCE (Proof Key for Code Exchange) passcode and the client secret, if applicable, to trade for an access token. The AI agent then passes this access token to the MCP server to unlock access.
OAuth client scopes
OAuth client scopes define the high-level permissions that an OAuth client is allowed to exercise on an AI agent’s or user’s behalf when it interacts with an IDMC MCP server. Configure OAuth client scopes to limit the level of access the client has to your organization’s objects and assets.
OAuth client scopes enforce the principle of least privilege. They ensure that the client application only requests the minimum permissions it needs to function. The authorization server embeds the granted scopes into the issued access token, and the resource server enforces those limits on every request. If the client tries to call a tool without the matching scopes, the resource server rejects the request.
Select the applicable scopes for an OAuth client on the Scopes page when you create or edit an Authorization Code client. The authorization code endpoint call from your MCP client includes these scopes. Select all the scopes that your client needs. For example, if your client needs to start an import job and import assets into a target organization, select both the Execute (mcp:tools:execute) and Write (mcp:tools:write) scopes.
Tip:
You can view the scopes associated with an MCP server's tools and resources on the MCP Components page when you create or edit an OAuth client. You can also view them on the MCP server details page.
After you select scopes, you choose the MCP servers, tools, and resources that the client can access on the MCP Components page. The tools and resources you can select are filtered by the selected scopes. For example, if you enable only the Execute (mcp:tools:execute) scope, you can't select tools that have the Read (mcp:tools:read) or Write (mcp:tools:write) scope, even if those tools also have the Execute (mcp:tools:execute) scope. If you enable the Read (mcp:resources:read) scope, then every resource associated with the MCP server is selected by default. If you don't enable this scope, you can't select any resources.
You can configure your OAuth client with the following scopes:
Read (mcp:tools:read)
Allows the client to call tools that are classified as read-only. Read-only tools return data, including file contents, database rows, and API results. Also allows listing tool names and input schemas.
Doesn’t allow the client to call tools that create, update, or delete data, or call tools that start or control jobs. Doesn’t allow the client to read MCP resources or prompts.
Write (mcp:tools:write)
Allows the client to call tools that create, update, or delete stored data. Allows writing to a file, inserting or changing database rows, and creating, updating, or deleting objects.
Doesn’t allow starting, resuming, or controlling jobs or processes.
Execute (mcp:tools:execute)
Allows the client to call tools that start or control jobs and processes, for example, starting a taskflow or resuming a job.
Doesn’t allow reading, creating, updating, or deleting stored data.
Read (mcp:resources:read)
Allows the client to list and read resources the MCP server publishes, like skill files, database schemas, or API specifications.
Doesn’t allow the client to create, change, or delete resources, or to call tools.
Adding an Authorization Code client
Adding an Authorization Code client generates the client ID and, if applicable, the secret that the Informatica OAuth server uses to generate an access token.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, expand the Informatica OAuth Server (Authorization Code Grant) section.
3Click Add Authorization Code Client.
The Add Authorization Code Client wizard opens.
4On the Details page, enter a name for the OAuth client, specify whether the client is confidential or public, and click Next.
When you register a Claude Code or Cursor client, always set it as a public client.
5On the Redirect URIs page, enter one or more URIs where the OAuth server sends the user and their temporary authorization code after the user logs in and grants permission.
6On the Scopes page, select one or more OAuth client scopes and click Next.
7On the MCP Components page, select the MCP servers you want to connect to and the tools and resources you want to access, and then click Create.
The lists of tools and resources you can select are filtered by the OAuth scopes you select on the Scopes page. The client can only access the selected tools and resources in each selected MCP server.
8On the Generate Credentials page, copy the client ID and, if applicable, the client secret.
You'll use these values to generate an access token for the MCP server.
Note:
The client secret isn't available after you close the wizard. If you lose this value, you can regenerate a secret.
Editing an Authorization Code client
Edit an Authorization Code client when you want to change the name, the redirect URIs, or the MCP servers you want to connect to.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, expand the Informatica OAuth Server (Authorization Code Grant) section.
3Click the edit icon in the row that contains the client you want to edit.
The Edit Authorization Code Client wizard opens.
4On the Details page, update the OAuth client name and click Next.
Note:
You can't edit the authentication method after you create the client.
5On the Redirect URIs page, add or remove URIs and click Next.
6On the Scopes page, update the OAuth client scopes and click Next.
7On the MCP Components page, update the MCP servers you want to connect to and the tools and resources you want to access.
The client can only access the selected tools and resources in each selected MCP server.
8Click Update.
Regenerating client secrets for an Authorization Code client
If the Authorization Code client is confidential, you can regenerate the client secret. Regenerate the client secret if you want to change the credentials or if you failed to copy the secrets when you created the client.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, open the Actions menu in the row that contains the client and click Regenerate Secret.
The Regenerate Client Secret page opens.
3Copy the client ID and client secret.
You'll use these values to generate an access token for the MCP server.
Note:
The client secret isn't available after you close the page. If you lose the value, you can regenerate a secret.
4Click Finish.
Client Credentials flow
The Client Credentials flow directly authenticates machine-to-machine communication without user intervention.
When you use the Client Credentials flow, the registration process generates a client ID and a client secret. The Informatica OAuth server generates an access token for the AI agent based on these credentials. The access token is then passed to the MCP server, allowing your AI agent to access the MCP server.
Adding a Client Credentials client
Adding a Client Credentials client generates the client ID and secret that the Informatica OAuth server uses to generate an access token. The credentials also include the authentication header value, which is the Base64 encoding of the client ID and secret.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, expand the Informatica OAuth Server (Client Credentials Grant) section.
3Click Add Client Credentials Client.
The Add Client Credentials Client wizard opens.
4On the Authentication page, enter your IDMC user name and password and click Next.
5On the Details page, enter a name for the OAuth client, an optional description, and the access token timeout value and click Next.
The default value for the access token timeout value is 5 minutes. You can enter a value between 5 minutes and 1440 minutes (24 hours).
6On the MCP Components page, select the MCP servers you want to connect to and click Create.
7On the Generate Credentials page, copy either the client ID and client secret or the authentication header value.
You'll use these values to generate an access token for the MCP server.
Note:
The secret and authentication header values aren't available after you close the wizard. If you lose these values, you can regenerate the client secret.
8Click Finish.
Editing a Client Credentials client
Edit a Client Credentials client when you want to change the name, description, access token timeout value, or MCP servers you want to connect to.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, expand the Informatica OAuth Server (Client Credentials Grant) section.
3Click the edit icon in the row that contains the client you want to edit.
The Edit Client Credentials Client wizard opens.
4On the Authentication page, enter your IDMC user name and password and click Next.
5On the Details page, update the OAuth client name, description, or access token timeout value and click Next.
The default value for the access token timeout value is 5 minutes. You can enter a value between 5 minutes and 1440 minutes (24 hours).
6On the MCP Components page, update the MCP servers you want to connect to and click Update.
Regenerating client secrets for a Client Credentials client
You can regenerate the client secret if you want to change the credentials or if you failed to copy the secret when you created a Client Credentials client.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, open the Actions menu in the row that contains the client and click Regenerate Secret.
The Regenerate Client Secret wizard opens.
3On the Authentication page, enter your IDMC user name and password and click Next.
4On the Generate Credentials page, copy either the client ID and client secret or the authentication header value.
You'll use these values to generate an access token for the MCP server.
Note:
The secret and authentication header values aren't available after you close the wizard. If you lose these values, you can regenerate the client secret.
5Click Finish.
Downloading an OAuth client report
You can download a CSV file that contains information about the Client Credentials clients. The file lists the name, description, status, MCP servers, and last update date for each client.
The CSV file lists all Client Credentials clients in the organization. Filters that you apply on the MCP Server Authorization page don't apply to the download file.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, expand the Informatica OAuth Server (Client Credentials Grant) section.
3Click the Download CSV icon.
Disabling and enabling a Client Credentials client
When you create a Client Credentials client, it's enabled automatically. You can disable a client to prevent it from getting tokens. If you disable a client, you can re-enable it later.
You might want to disable a client if it becomes compromised.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, expand the Informatica OAuth Server (Client Credentials Grant) section.
3Open the Actions menu in the row that contains the client and click Disable or Enable.
Deleting an OAuth client
You can delete an OAuth client that's no longer needed.
1Click Configuration in the navigation menu on the left.
2On the MCP Server Authorization page, click the Delete icon in the row that contains the client you want to delete.
