---
title: Authentication
description: "AtlasMCP provides secure authentication methods for connecting external AI clients to your WordPress MCP server. You can use the recommended **OAuth 2.1 connection** for supported MCP clients or generate **authentication tokens** for token-based MCP access. To configure Authentication settings follow…"
url: "https://wpatlasmcp.com/docs/authentication/"
updated: "2026-09-27"
category: "Usage & Setup"
---

# Authentication

AtlasMCP provides secure authentication methods for connecting external AI clients to your WordPress MCP server. You can use the recommended **OAuth 2.1 connection** for supported MCP clients or generate **authentication tokens** for token-based MCP access.

To configure Authentication settings follow the below steps:

Navigate to AtlasMCP plugin dahsboad → click **Authentication** tab.

![atlasmcp authentication](https://wpatlasmcp.com/wp-content/uploads/2026/09/atlasmcp-authentication-923x1024.jpeg)
atlasmcp authentication

## One-Click OAuth 2.1 Connect

The **OAuth 2.1 connection** is the recommended way to connect Claude, ChatGPT, Cursor, and other supported MCP clients to AtlasMCP.

Simply provide your MCP server URL to the client. AtlasMCP handles the authentication and authorization process automatically using **OAuth 2.1 with PKCE** and **dynamic client registration**.

This means you don't need to manually create, copy, or manage client IDs, client secrets, or access tokens.

### Enable OAuth 2.1

To enable OAuth 2.1:

1. In your WordPress admin dashboard, go to **AtlasMCP → Authentication**.
2. Enable **Enable OAuth 2.1 connect for the MCP server**.
3. Click **Save**.
4. Your MCP server is now ready to accept OAuth connections from supported MCP clients.

Once enabled, connected clients can be viewed from the **Connected Clients** section.

For detailed instructions, see the **Connect Claude to WordPress with OAuth** guide.

## Authentication Tokens

Authentication tokens provide an alternative way to authenticate external MCP clients with your WordPress MCP server. These tokens use **JSON Web Tokens (JWT)** and provide secure, stateless authentication for MCP protocol access.

### How Authentication Tokens Work

- **Temporary access** — Tokens are generated with an expiration time and automatically become invalid after that period.
- **User-based permissions** — Tokens inherit the WordPress user's role and capabilities.
- **MCP access** — Tokens provide authenticated access to your WordPress MCP endpoints.
- **Individual tokens** — Each generated token is unique and can be revoked individually if necessary.

### Generate an Authentication Token

To generate a token:

1. Go to **AtlasMCP → Authentication** in your WordPress dashboard.
2. Open the **Authentication Tokens** section.
3. Select the desired **Token Duration**.
4. Choose the duration that meets your access requirements.
5. Click **Generate New Token**.
6. Copy and securely store the generated token.

Available durations include options such as:

- 1 hour
- 2 hours
- 6 hours
- 12 hours
- 24 hours (1 day)
- Additional durations available from the **More** option.

### Managing Active Tokens

The **Your Active Tokens** section displays the tokens that have been generated for your account.

The token list includes information such as:

- **User**
- **Issued At**
- **Expires At**
- **Status**
- **Actions**

This allows you to review active tokens and manage them when necessary.

## Authentication Token Security

Authentication tokens provide access based on the permissions of the WordPress user who generated them. Keep them secure and treat them like sensitive credentials.

### Security Best Practices

- **Never share tokens publicly** in repositories, emails, chat messages, or other public locations.
- **Use the shortest expiration period** that meets your requirements.
- **Revoke tokens immediately** if you believe they may have been compromised.
- **Regularly review active tokens** and remove tokens that are no longer needed.

### Important Note

Authentication tokens are intended specifically for **MCP protocol access**, including stdio and streamable HTTP.

They do **not** authenticate WordPress REST API endpoints or other authentication systems.

A token provides access according to the permissions of the WordPress user associated with it. If that user has permission to access or modify something in WordPress, an application using that user's MCP token may also be able to access or modify it through the available MCP abilities.