Authentication

AtlasMCP provides secure authentication methods for connecting external AI clients to your WordPress MCP server. You can use the recommended OAuth 2.1 connection for supported MCP clients or generate authentication tokens for token-based MCP access.

To configure Authentication settings follow the below steps:

Navigate to AtlasMCP plugin dahsboad → click Authentication tab.

One-Click OAuth 2.1 Connect #

The OAuth 2.1 connection is the recommended way to connect Claude, ChatGPT, Cursor, and other supported MCP clients to AtlasMCP.

Simply provide your MCP server URL to the client. AtlasMCP handles the authentication and authorization process automatically using OAuth 2.1 with PKCE and dynamic client registration.

This means you don’t need to manually create, copy, or manage client IDs, client secrets, or access tokens.

Enable OAuth 2.1 #

To enable OAuth 2.1:

1. In your WordPress admin dashboard, go to AtlasMCP → Authentication.
2. Enable Enable OAuth 2.1 connect for the MCP server.
3. Click Save.
4. Your MCP server is now ready to accept OAuth connections from supported MCP clients.

Once enabled, connected clients can be viewed from the Connected Clients section.

For detailed instructions, see the Connect Claude to WordPress with OAuth guide.

Authentication Tokens #

Authentication tokens provide an alternative way to authenticate external MCP clients with your WordPress MCP server. These tokens use JSON Web Tokens (JWT) and provide secure, stateless authentication for MCP protocol access.

How Authentication Tokens Work #

• Temporary access — Tokens are generated with an expiration time and automatically become invalid after that period.
• User-based permissions — Tokens inherit the WordPress user’s role and capabilities.
• MCP access — Tokens provide authenticated access to your WordPress MCP endpoints.
• Individual tokens — Each generated token is unique and can be revoked individually if necessary.

Generate an Authentication Token #

To generate a token:

1. Go to AtlasMCP → Authentication in your WordPress dashboard.
2. Open the Authentication Tokens section.
3. Select the desired Token Duration.
4. Choose the duration that meets your access requirements.
5. Click Generate New Token.
6. Copy and securely store the generated token.

Available durations include options such as:

• 1 hour
• 2 hours
• 6 hours
• 12 hours
• 24 hours (1 day)
• Additional durations available from the More option.

Managing Active Tokens #

The Your Active Tokens section displays the tokens that have been generated for your account.

The token list includes information such as:

• User
• Issued At
• Expires At
• Status
• Actions

This allows you to review active tokens and manage them when necessary.

Authentication Token Security #

Authentication tokens provide access based on the permissions of the WordPress user who generated them. Keep them secure and treat them like sensitive credentials.

Security Best Practices #

• Never share tokens publicly in repositories, emails, chat messages, or other public locations.
• Use the shortest expiration period that meets your requirements.
• Revoke tokens immediately if you believe they may have been compromised.
• Regularly review active tokens and remove tokens that are no longer needed.

Important Note #

Authentication tokens are intended specifically for MCP protocol access, including stdio and streamable HTTP.

They do not authenticate WordPress REST API endpoints or other authentication systems.

A token provides access according to the permissions of the WordPress user associated with it. If that user has permission to access or modify something in WordPress, an application using that user’s MCP token may also be able to access or modify it through the available MCP abilities.