> ## Documentation Index
> Fetch the complete documentation index at: https://develop.cotality.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

All requests to Cotality MCP require an access token, which you obtain using your provided `client_id` and `client_secret` OAuth2 credentials.

## Overview

1. Use your `client_id` and `client_secret` as HTTP basic auth credentials to request an access token from the token endpoint
2. Extract the `access_token` from the response
3. Include the `access_token` as a bearer token on all subsequent requests to Cotality MCP

## Step 1: Request an access token

Send a `POST` request to the token endpoint for your target environment with your credentials as basic auth:

| Environment    | Token endpoint                                                           |
| :------------- | :----------------------------------------------------------------------- |
| **UAT**        | `https://mcp-uat.cotality.com/oauth/token?grant_type=client_credentials` |
| **Production** | `https://mcp.cotality.com/oauth/token?grant_type=client_credentials`     |

```bash theme={null}
curl -X POST "https://mcp.cotality.com/oauth/token?grant_type=client_credentials" \
     -u "<your_client_id>:<your_client_secret>" \
     -H "Content-Length: 0"
```

## Step 2: Extract the access token

The response contains your access token in the `access_token` field:

```json theme={null}
{
  "access_token": "GNdlinr2kVNj3igGI7y176vheYrF",
  "token_type": "Bearer",
  "expires_in": 3599
}
```

## Step 3: Use the token

Include the `access_token` value as a bearer token in the `Authorization` header on your Cotality MCP connection:

```
Authorization: Bearer GNdlinr2kVNj3igGI7y176vheYrF
```

Most MCP clients (VS Code, Python SDK, etc.) accept a bearer token or headers configuration — see [Integration guides](../mcp/guide) for some common client-specific setups.

## Token expiry

Tokens expire after the duration specified in `expires_in` (in seconds). When your token expires, Cotality MCP will reject requests with `401 Unauthorized`. Request a new token using the same process.