> **Building with AI coding agents?** If you're using an AI coding agent, install the official Scalekit plugin. It gives your agent full awareness of the Scalekit API — reducing hallucinations and enabling faster, more accurate code generation.
>
> - **Claude Code**: `/plugin marketplace add scalekit-inc/claude-code-authstack` then `/plugin install <auth-type>@scalekit-auth-stack`
> - **GitHub Copilot CLI**: `copilot plugin marketplace add scalekit-inc/github-copilot-authstack` then `copilot plugin install <auth-type>@scalekit-auth-stack`
> - **Codex**: run the bash installer, restart, then open Plugin Directory and enable `<auth-type>`
> - **Skills CLI** (Windsurf, Cline, 40+ agents): `npx skills add scalekit-inc/skills --list` then `--skill <skill-name>`
>
> `<auth-type>` / `<skill-name>`: `agent-auth`, `full-stack-auth`, `mcp-auth`, `modular-sso`, `modular-scim` — [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Agent / Machine interacting with MCP Server

An **autonomous agent** or any **machine-to-machine process** can directly interact with an **MCP Server** secured by Scalekit. In this model, the agent acts as a **confidential OAuth client**, authenticated using a `client_id` and `client_secret` issued by Scalekit.

This topology uses the **OAuth 2.1 Client Credentials flow**, allowing the agent to obtain an access token without user interaction. Tokens are scoped and time-bound, ensuring secure and auditable automation between services.
**Flow Summary:** The agent authenticates with Scalekit using the **OAuth 2.1 Client Credentials Flow** to obtain a scoped access token, then calls the MCP Server's tools using that token for secure, automated communication.

---

## Authorization Sequence
<br/>

```d2 pad=36
title: "Agent ? MCP Server (OAuth 2.1 Client Credentials Flow)" {
  near: top-center
  shape: text
  style.font-size: 18
}

shape: sequence_diagram

Agent -> Scalekit Authorization Server: Request access token (grant_type=client_credentials)
Scalekit Authorization Server -> Agent: Return access token with configured scopes
Agent -> MCP Server: Call tool with Bearer token
MCP Server -> Agent: Authorized response
```

---

## How It Works

**Client Registration**
   Before an agent can request tokens, you must create a **Machine-to-Machine (M2M) client** for your MCP Server in Scalekit.

   Steps to create a client:
1. Navigate to **Dashboard ? MCP Servers** and select your MCP Server. Go to the **Clients** tab.
   ![Clients tab placeholder](@/assets/docs/guides/mcp/mcp-client-nav.png)
2. Click **Create Client**.
   ![Create client placeholder](@/assets/docs/guides/mcp/mcp-clients-tab.png)
3. Copy the **client_id** and **client_secret** immediately - the secret will not be shown again.
   ![Client Sidesheet](@/assets/docs/guides/mcp/mcp-client-sidesheet.png)
4. Optionally, set scopes (e.g., `todo:read`, `todo:write`) that correspond to the permissions configured for your MCP Server. Hit **Save**

---

## Requesting an Access Token

Once you have the client credentials, the agent can request a token directly from the Scalekit Authorization Server:

```bash title="Terminal" frame="terminal"
curl --location '{{env_url}}/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id={{client_id}}' \
--data-urlencode 'client_secret={{secret_value}}' \
--data-urlencode 'scope=todo:read todo:write'
```

Scalekit responds with a JSON payload similar to:
```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIn0...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "todo:read todo:write"
}
```
Use the `access_token` in the `Authorization` header when calling your MCP Server's endpoint.
**Tip:** Scalekit issues short-lived tokens that can be safely reused until they expire. Cache the token locally and request a new one shortly before expiration to maintain efficient, secure machine-to-machine communication.

---

## Try It Yourself

If you'd like to simulate this flow, use the same **FastMCP Todo Server** from the [FastMCP Example](/authenticate/mcp/fastmcp-quickstart).
Create an **M2M client** in the Scalekit Dashboard and run your token request using `curl` or programmatically within your agent. Once the token is obtained, attach it as a Bearer token in the `Authorization` header when calling your MCP Server's tools.

---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |