Obtain Required Connection Details

Before configuring a client, register a confidential application in your Oracle identity domain, or reuse an existing one that is approved for Essbase access. Refer to Create a Confidential Identity Application for more information.

Before trying to connect to Essbase MCP server, you must gather the MCP endpoint, identity-domain URLs, client ID, client secret, scopes, and redirect URI.

You will need to collect the following information:

MCP endpoint – The web address of the Essbase MCP Server.
```
https://<essbase-server>/essbase/rest/v1/ess-mcp
```
Example:
```
https://myserver.example.com:9001/essbase/rest/v1/ess-mcp
```
Example with an access profile specified:
```
https://myserver.example.com:9001/essbase/rest/v1/ess-mcp?profile=viewer
```
When you are ready to verify the MCP endpoint, refer to Verify the MCP Endpoint.
Identity domain base URL – Find this from the OCI Console, under your identity domain details.
```
https://<identity-domain>
```
Example:
```
https://idcs-1234567890abcdef.identity.oraclecloud.com
```
Authorization URL – The web address where a user signs in and approves access. Find this from the Oracle identity domain's OAuth configuration, or derive it from the identity domain base URL.
```
https://<identity-domain>/oauth2/v1/authorize
```
Example:
```
https://idcs-1234567890abcdef.identity.oraclecloud.com/oauth2/v1/authorize
```

Token URL – The web address where the client requests an OAuth access token.

https://<identity-domain>/oauth2/v1/token

Example:

https://idcs-1234567890abcdef.identity.oraclecloud.com/oauth2/v1/token

Token endpoint authentication method – The method the client uses to prove its identity when requesting a token.
May be client_secret_post or client_secret_basic.
Client ID and client secret – Find these from the integrated application in the identity domain, in its OAuth configuration > General Information section.

Choose the Correct OAuth Scope

An OAuth scope tells the identity service what resource the client wants permission to access. Use the scope that matches the client’s authentication method:

For ChatGPT and Claude Code, use the IDCS meta-scope:
```
urn:opc:idm:__myscopes__
```
For Codex tokens created with the password grant, use the Essbase resource scope configured for your application.
```
https://<identity-domain>:443/essbase
```

Using the correct scope ensures that the issued token is valid for Essbase.

ChatGPT and Claude Code return the user to the client after sign-in. That return address is called a redirect URI or callback URI.

Register the callback URI provided by each client in the confidential application. Each client may use a different callback URI, so add them separately.