Skip to help content
tidyboard

AI and integrations

Configure Cognito OAuth for MCP

Administrator guidance for OAuth discovery, resource binding, client registration, scopes, and callback URLs.

Required configuration

  1. Configure the Cognito issuer and JWKS source used to validate access tokens.
  2. Bind tokens to the Tidyboard MCP resource or audience.
  3. Register the scopes exposed by the protected-resource metadata.
  4. Register the exact callback URLs required by each supported AI client.
  5. Expose both the API and Cognito domain over HTTPS.

Tidyboard server settings

Example environment values
TIDYBOARD_AUTH_COGNITO_REGION=us-west-2
TIDYBOARD_AUTH_COGNITO_USER_POOL_ID=us-west-2_EXAMPLE
TIDYBOARD_MCP_ENABLED=true
TIDYBOARD_MCP_RESOURCE_URL=https://api.your-tidyboard.example/mcp
TIDYBOARD_MCP_AUTHORIZATION_SERVER_URL=https://cognito-idp.us-west-2.amazonaws.com/us-west-2_EXAMPLE
TIDYBOARD_MCP_CLIENT_ID=your-dedicated-public-client-id

Validate discovery

  1. Open /.well-known/oauth-protected-resource on the public API host.
  2. Confirm the resource URL is the HTTPS /mcp endpoint.
  3. Confirm the authorization-server metadata points to the expected Cognito issuer.
  4. Connect with a test user that has limited household permissions.