Authentication - Cotality developer portal

All requests to Cotality MCP require an access token, which you obtain using your provided client_id and client_secret OAuth2 credentials.

Overview

Use your client_id and client_secret as HTTP basic auth credentials to request an access token from the token endpoint
Extract the access_token from the response
Include the access_token as a bearer token on all subsequent requests to Cotality MCP

Step 1: Request an access token

Send a POST request to the token endpoint for your target environment with your credentials as basic auth:

Environment	Token endpoint
UAT	`https://mcp-uat.cotality.com/oauth/token?grant_type=client_credentials`
Production	`https://mcp.cotality.com/oauth/token?grant_type=client_credentials`

curl -X POST "https://mcp.cotality.com/oauth/token?grant_type=client_credentials" \
     -u "<your_client_id>:<your_client_secret>" \
     -H "Content-Length: 0"

Step 2: Extract the access token

The response contains your access token in the access_token field:

{
  "access_token": "GNdlinr2kVNj3igGI7y176vheYrF",
  "token_type": "Bearer",
  "expires_in": 3599
}

Step 3: Use the token

Include the access_token value as a bearer token in the Authorization header on your Cotality MCP connection:

Authorization: Bearer GNdlinr2kVNj3igGI7y176vheYrF

Most MCP clients (VS Code, Python SDK, etc.) accept a bearer token or headers configuration — see Integration guides for some common client-specific setups.

Token expiry

Tokens expire after the duration specified in expires_in (in seconds). When your token expires, Cotality MCP will reject requests with 401 Unauthorized. Request a new token using the same process.

​Overview

​Step 1: Request an access token

​Step 2: Extract the access token

​Step 3: Use the token

​Token expiry

Overview

Step 1: Request an access token

Step 2: Extract the access token

Step 3: Use the token

Token expiry