Identity Brokering
Identity Brokering is the fastest way to get a working connection. Your users sign in through LockMCP directly — there's no identity provider to register, no login page to build, and no auth endpoints to host. Step 3 of the wizard asks you for nothing at all.
It's also the model that works best with desktop AI clients like Claude Desktop and ChatGPT, because it supports the interactive browser sign-in those clients expect.
This page and everything under Identity Brokering in the sidebar apply only to connections whose identity model is Identity Brokering. Using a different model? See Token Exchange or Tenant Delegated.
When to choose it
| Choose Identity Brokering when | Choose something else when |
|---|---|
| You want a connection working today with no auth work | Your users must sign in with existing corporate accounts → Token Exchange |
| Your users will connect from Claude Desktop, ChatGPT or Cursor | The login screen has to be your own branded UI → Tenant Delegated |
| You don't run an identity provider, or don't want to wire one up | Your backend must authorize every individual tool call → Tenant Delegated |
| You're evaluating LockMCP and want the shortest path to a demo |
Identity model is chosen per connection, so this isn't a one-way door. Many teams start here to get something working, then add a second connection using a different model once they know what they need.
What you need
Nothing beyond a verified domain. No identity provider, no login page, no auth endpoints, no HMAC key.
Your users get LockMCP accounts, and you manage who they are and what they can do from Members & Access in the dashboard.
That covers authentication infrastructure only. If this connection's tools call your own API — the common case — that API still receives the forwarded token on every call and must verify it itself. See Verifying the forwarded token in your own API — or skip straight to a ready-to-copy prompt for your coding agent that implements it for you.
Setting it up
Connections go through a five-step wizard that's the same for every identity model. Only Step 3 · Identity setup differs — and for Identity Brokering it's empty:
No extra setup — users sign in via the hub Keycloak realm.
In practice, domain verification (Step 2) is the only step that can hold you up. Everything else is a click.
See Configuration for what provisioning creates on your behalf.
How sign-in works
- An AI client hits your connection's MCP endpoint and gets a
401pointing at the authorization server. - The client opens a browser to LockMCP's sign-in page.
- The user signs in.
- LockMCP issues a token carrying the user's roles, tenant and permissions.
- Tool calls present that token; LockMCP verifies it and enforces the user's tool access.
Because this is a standard interactive browser flow, AI clients that handle OAuth themselves — Claude Desktop, Cursor, ChatGPT connectors — work without extra configuration. Full detail on the Auth Flow page.
Managing users
Users are managed entirely in the dashboard under Members & Access:
- Invite users by email.
- Assign roles — every connection gets an admin role and a standard member role by default.
- Control which published tools each role can call.
Since LockMCP holds the accounts, offboarding is immediate: remove the member and their access ends.
Where to go next
| Page | What it's for |
|---|---|
| Configuration | What the (empty) setup step means and what provisioning creates |
| Auth Flow | The full sequence, from sign-in to a verified tool call |
| Troubleshooting | When sign-in or tool access doesn't behave |