# Connect the MCP server with OAuth

> The MCP server moves to mcp.openwaf.dev/mcp with OAuth 2.1: give your client the URL, sign in and choose the organization, role and expiry.

The MCP server now lives at `https://mcp.openwaf.dev/mcp` and supports MCP authorization (OAuth 2.1). Give your client the URL; it opens the dashboard, where you sign in and choose the organization, a role no higher than yours and an expiry of 7, 30 or 90 days. The connection shows up in **API tokens** with the «OAuth app» badge and is revoked there. API tokens keep working, and the older `https://dash.openwaf.dev/v1/mcp` keeps answering with API tokens.

See [connect a client](https://developers.openwaf.dev/mcp/connect/) and [OAuth and tokens](https://developers.openwaf.dev/mcp/oauth-and-tokens/).