Marco Polo Authentication

generated: '2026-07-20'
method: searched
source: https://mcp.marcopolo.dev/.well-known/oauth-authorization-server + https://docs.marcopolo.dev/getting-started
provider: marco-polo
summary: >-
  MarcoPolo authenticates MCP clients with OAuth 2.0 (authorization-code + PKCE,
  plus a device-authorization grant), fronted by WorkOS AuthKit. End users sign
  in with Google, Microsoft, GitHub, or email; the issued bearer token is sent in
  the Authorization header to the protected MCP resource at https://mcp.marcopolo.dev.
docs: https://docs.marcopolo.dev/getting-started
schemes:
- name: oauth2
  type: oauth2
  authorization_server: https://appealing-lion-77-staging.authkit.app
  authorization_endpoint: https://appealing-lion-77-staging.authkit.app/oauth2/authorize
  device_authorization_endpoint: https://appealing-lion-77-staging.authkit.app/oauth2/device_authorization
  token_endpoint: https://appealing-lion-77-staging.authkit.app/oauth2/token
  registration_endpoint: https://appealing-lion-77-staging.authkit.app/oauth2/register
  jwks_uri: https://appealing-lion-77-staging.authkit.app/oauth2/jwks
  issuer: https://appealing-lion-77-staging.authkit.app
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:device_code
  scopes_supported:
  - openid
  - profile
  - email
  - offline_access
  code_challenge_methods:
  - S256
  token_delivery: bearer (Authorization header)
  token_endpoint_auth_methods:
  - none
  - client_secret_post
  - client_secret_basic
  dynamic_client_registration: 'supported (RFC 7591 registration_endpoint + client_id metadata documents)'
  metadata_standards:
  - RFC 8414 (Authorization Server Metadata)
  - RFC 9728 (Protected Resource Metadata)
  identity_providers:
  - Google
  - Microsoft
  - GitHub
  - Email
identity_mapping: >-
  Domain-based identity mapping connects users to their company environment for
  shared workspace resources.