Tutorial: Setting Up OAuth 2.0 Authentication for FME Flow MCP Servers

Introduction

Since FME 2026.2, FME Flow includes MCP Server capabilities, allowing AI clients to discover and run FME workspaces. FME Flow's MCP Servers can be configured to use OAuth 2.0 authentication to keep MCP tools secure and controlled within your organization.

OAuth for an MCP Server involves three components working together: the client (the AI application requesting tools), the identity provider (which verifies users and issues access tokens), and FME Flow (which validates each token and runs the tools as the matched FME Flow user, with their permissions applied).

While many identity provider and client combinations can be used, this tutorial walks through configuring MCP OAuth with Auth0 as the identity provider and LM Studio as the client. The concepts shown here apply to other combinations as well.

Note: Identity providers and clients often use different terminology for the same concepts. The table below maps the terms used in this article to their common equivalents:

Requirements

• FME Flow 2026.2+, accessible over HTTPS with a certificate the client machine trusts
• An Auth0 account
• LM Studio
• Administrative access to both FME Flow and the identity provider
• Configuring FME Flow for SAML Authentication completed
• Returning Text Content from an FME MCP Tool completed, or familiarity with how to create an MCP server in FME Flow

Step-by-Step Instructions

This tutorial is organized into six parts: Part 1 configures the global IdP environment. SAML (Part 2) creates the FME Flow user account and stores the account ID attribute that OAuth tokens are later matched against. Parts 3 and 4 register the two identities Auth0 needs to know about (the MCP Server and the client), Part 5 connects FME Flow to Auth0, and Part 6 brings the client online.

Part 1: Configure Global Identity Provider Settings

Before creating any applications or APIs in our identity provider, we need to ensure the global environment is configured correctly. Depending on the IdP you are using, we will also need to record the tenant name or tenant ID (tid). The rest of the instructions below will use Auth0 as the Identity provider.

1. Record the Tenant Domain

On the Auth0 homepage under Settings > General, record your tenant's domain name. This value is needed later to build the Authorization Server URL in FME Flow.

In Auth0, the tenant domain is the issuer, the formal identity of the login service that gets stamped into every token.

2. Enable the Resource Parameter Compatibility Profile

MCP clients declare their destination with the RFC 8707 resource parameter, and the identity provider must translate that into the token's audience. This setting tells Auth0 to honor that parameter. 

Under Settings > Advanced, enable Resource Parameter Compatibility Profile and click Save.

Optionally, enable Client Metadata Document (CIMD) Registration if you will be connecting to a client that provides a Client ID Metadata URL.

Part 2: Configure SAML and the Account ID Attribute

In this part, you'll configure the SAML authentication. OAuth alone doesn't tell FME Flow which user is signing in. When someone authenticates through your identity provider, FME Flow reads the flowaccountid attribute from their SAML profile and uses it to match the OAuth token to the corresponding FME Flow user account. Without this attribute correctly configured, FME Flow has no way to resolve the token to a real user.

1. Configure SAML Between Auth0 and FME Flow

First, begin by configuring SAML on the FME Flow machine. Complete Part 1: Identity Provider Configuration of Configuring FME Flow for Auth0 SAML Authentication.

See the Configuring FME Flow for SAML Authentication article for instructions for other common identity providers.

Do not upload the Identity Provider Metadata File yet (that happens in step 3).

2. Add the flowaccountid Attribute Mapping

In the configuration menu for the SAML2 Web App addon, under the Settings tab, add the following attribute mapping to the JSON settings and click Save:

{
  "mappings": {
    "user_id": [
      "flowaccountid",
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
    ]
  }
}

This mapping is the link between the two authentication systems: Auth0's OAuth access tokens identify the user with the sub claim, which contains the Auth0 user_id (for example, auth0|abc123…). This mapping makes the SAML assertion carry that same value as the flowaccountid attribute, which is what allows FME Flow to match an OAuth token to the SAML-provisioned user.

To confirm the mapping was added correctly, click the Debug button and check that the decoded SAML response contains an attribute named flowaccountid with a value beginning with auth0|.

3. Log In to FME Flow via SAML to Provision the User

Complete Part 2: FME Flow Configuration and Part 3: Test your Configuration of Configuring FME Flow for Auth0 SAML Authentication.

Logging in for the first time creates the FME Flow user account and stores the flowaccountid value on it. Every user who will access the MCP Server through OAuth must log in via SAML at least once. Verify the account was created under User Management.

Part 3: Register LM Studio as an Application

In this part, you'll register LM Studio as a client that Auth0 recognizes with an approved return address for login results. LM Studio requires the resulting client ID to be provided in its mcp.json configuration file.

1. Create a Native Application

Return to the Auth0 portal. On the Applications page, create a new application for LM Studio and set the type to Native.

2. Set the Allowed Callback URL

Under Settings for the newly created application, scroll down to Application URIs, and set Allowed Callback URLs to:

http://127.0.0.1:33389/mcp-oauth-callback

as specified in the LM Studio documentation.

Auth0 will only return login results to pre-registered addresses. The exact value comes from the client's documentation; when adapting this tutorial, always use the value your client documents or displays.

3. Enable Refresh Token Rotation (optional)

If you plan on using refresh tokens, this step is required. Under the application's Settings, in the Refresh Token Rotation section set:

• Allow Refresh Token Rotation: Enabled
• Reuse Interval: A value of your choice, for example 30 seconds

Public clients receive rotating refresh tokens; each renewal invalidates the old token and issues a new one. 

4. Enable the Database Connection

Under Connections, ensure Username-Password-Authentication (or whichever connection your SAML users belong to) is enabled for this application. You may need to promote the connection to the domain level. Follow Auth0’s instructions to do so.

5. Record the Client ID

Return to the application's Settings and record the Client ID. This will be entered in LM Studio's configuration in Part 6.
 

Part 4: Configure Auth0 as the Authorization Server

Now that the SAML user exists and the flowaccountid is mapped, it's time to set up the authorization server side. In this section, we will register the MCP Server as a destination Auth0 knows about, so tokens are issued with the correct audience.

1. Create the API (the MCP Server's Identity)

From the Auth0 sidebar, navigate to Applications > APIs. Click Create API. Give the API a name, and enter the MCP Server URL as the Identifier:

https://<your-flow-host>/fmemcp/<server-name>/mcp

Important: The Identifier must match the MCP Server URL exactly, character for character. This value becomes the aud (audience) claim inside every token, and FME Flow compares it to its own URL exactly. A single character of difference produces tokens FME Flow will reject.

2. Enable Offline Access (Optional)

Under the API's Settings, enable Allow Offline Access. This permits clients to request refresh tokens, which lets them renew access silently instead of re-prompting for login each time the access token expires.
 

Note: If you enable this setting, you must also enable Refresh Token Rotation on the client application in Part 3, step 3.

3. Grant the Client Permissions

Under the Application Access tab, find the LM Studio application and click Edit.

Grant User-Delegated Access and Client Access. Click Save if prompted. 

Part 5: Create the OAuth-Authenticated MCP Server in FME Flow

In this section, we will configure the MCP Server on FME Flow to use OAuth 2.0 with our identity provider. 

1. Create or Edit the MCP Server

In FME Flow, on the MCP Servers page, create your MCP Server (or edit an existing one) with authentication type OAuth 2.0, and add the tools you want to expose. See Returning Text Content from an FME MCP Tool for step-by-step instructions on creating an MCP Server in FME Flow.

2. Set the Authorization Server URL

From the MCP Servers menu, select the Edit Authorization URL option and enter your Authorization Server URL. For Auth0, this is your tenant domain from Part 1. Depending on your region, your URL might look different.

https://<your-tenant>.us.auth0.com/

This field expects the issuer, the identity of the login service.

3. Register Allowed Users

On the MCP Server's Server Details tab, open the Security menu and add the SAML-provisioned user (and/or roles) from Part 2.

Part 6: Connect from LM Studio and Test

In this last section, we will configure the client to use our identity provider and test the authentication service.

1. Add the MCP Server to LM Studio

In LM Studio, navigate to the Integrations pane, select Install > Edit mcp.json, and add an entry for your MCP Server, including an auth object containing the Client ID from Part 4:

{
  "mcpServers": {
    "fme-flow": {
      "url": "https://<your-flow-host>/fmemcp/<server-name>/mcp",
      "auth": {
        "CLIENT_ID": "<your-client-id>"
      }
    }
  }
}

See LM Studio's MCP integration documentation for details.

2. Complete the Browser Login

The MCP Server connection appears in the Integrations side pane. Expand it and select Authenticate. Your browser should open to the Auth0 login page. Sign in as the SAML user from Part 2 and click Accept on the authorization screen.

If authentication was successful, you should see an Authentication Successful message in LM Studio

3. Verify and Run a Tool

On success, LM Studio shows the connection as ready and lists the server's tools. Confirm everything works end-to-end by invoking a tool in a chat and validating the response.

Troubleshooting

Login succeeds in the browser, but the client reports the connection failed or keeps re-prompting. 

The token was issued but FME Flow rejected it. Check the Auth0 log's seacft event: if audience is not your MCP Server URL, revisit the API Identifier (Part 3) and the compatibility profile (Part 1). If the audience is correct, verify the user logging in has signed in to FME Flow via SAML at least once (Part 2, step 3) and is on the MCP Server's allowed users list (Part 5, step 3).

"Unable to resolve the Configuration with the provided Issuer" in the FME Flow log, and clients receive a 401 with no details. The Authorization Server URL may be incorrect. Check for syntax errors in the authorization server URL.

Login succeeds, but FME Flow rejects the token as malformed or unreadable 

Most MCP clients, including LM Studio, tell Auth0 which server they need a token for automatically. Some clients do not; for those, set a tenant-wide fallback under Settings > General > API Authorization Settings > Default Audience.

I’ve enabled SAML, but the FME login page returns Login Failed every time I try to log in.

You may need to clear the page's memory due to stale page data. Open the browser developer tools (F12 on most keyboards) and navigate to the Application tab. Check including third-party cookies and select Clear Site Data. Try the login again.