Procedure

1. On the authorization server card, find Brokered consent and click Configure.
   The Configure brokered consent page opens.
2. Enter the authorization server settings.
   1. If you're using an Okta custom authorization server, select it from the Okta custom authorization server list. The Issuer, Authorize endpoint URL, and Token endpoint URL are filled in for you.
   2. If you're using an external authorization server, enter an Issuer, Authorization endpoint URL, and Token endpoint URL. If the authorization server supports Dynamic Client Registration (DCR), enter the DCR registration URL.
3. Click Save.
4. Add credentials for the MCP server.
   1. Enter a Client credentials name.
   2. Select a client registration type.

      You can't switch to another registration type after saving.

   3. If you select Static credentials (client ID and secret), enter your Client ID and Client secret.

      You must configure the client as a confidential client using the authorization code flow, which requires a client ID and client secret.

   4. If you select Dynamic Client Registration, Okta registers a client with the provider and populates the credentials.

      This option is only available if you provided a DCR registration URL.

   5. Select All available scopes, or select Customize scopes to choose or add specific scopes.

      For an external authorization server, scopes are automatically populated when available through metadata discovery.

5. Click Save.
6. If you have Agent Gateway enabled, click Test credentials and discover tools to validate your credentials and view available tools.
7. To create more client credentials sets, click Add and repeat the previous steps.
8. Click Done and close.

   The MCP server appears on the MCP Servers page and can have one of the following statuses:

   • ACTIVE: The default status for newly added MCP servers.
   • INACTIVE: An admin has deactivated the MCP server and you can't use it for managed connections.
   • INVALID: The MCP server is missing authorization server information or contains corrupted metadata.