OAuth connections
Some MCP integrations require OAuth authorization — you need to grant Anter permission to access a service on your behalf. There are two OAuth modes, and each has a slightly different setup flow.
Browser OAuth
Browser OAuth is used when the service requires you to sign in and authorize access interactively — for example, connecting Google Drive with your own account.
Setting up a browser OAuth connection
When you connect a service that uses browser OAuth, creating the connection is only the first step. After the server is added to the Connected section, its health badge reads Action needed — this means the OAuth credentials haven't been linked yet and the server isn't functional.
To complete the connection:
Open the Configure panel
Click Configure on the server card in the Connected section.
Find the OAuth Account Connection section
Near the bottom of the panel, an OAuth Account Connection section shows the current status as Not authenticated.
Click Connect Account
Anter opens an authorization popup — a standard OAuth consent screen from the service (for example, Google's "Sign in" flow). Sign in and grant the requested permissions.
Confirm success
When authorization completes, the popup closes and the status updates to Connected with the authorized account and token expiration if applicable. The server's health badge changes to Healthy.
Revoking access
To disconnect your account from a browser OAuth server without removing the server itself, open the Configure panel and click Revoke in the OAuth Account Connection section. This removes the stored token. The server's badge returns to Action needed until you reconnect.
Revoking is useful when you need to rotate credentials or re-authorize under a different account without changing the server configuration.
Stored refresh token OAuth
Some services issue a long-lived refresh token during a one-time setup outside Anter — for example, after completing a service's initial authorization flow in their own UI. You paste that token into Anter, and Anter exchanges it for access tokens automatically going forward.
When you connect a service using this mode:
- A Refresh token field appears in the connection form
- Paste the refresh token you obtained from the service
- Submit the form — Anter stores the token encrypted and uses it to acquire access tokens when the server is called
There is no browser popup step. The connection is ready as soon as the form is saved.
Service account (Domain-Wide Delegation)
For Google Workspace services that use a service account with Domain-Wide Delegation:
- The connection form shows a Service account JSON field — paste the full JSON key file content
- A DWD scopes field accepts the OAuth scopes the service account is authorized for
- Submit — Anter uses the service account credentials to acquire tokens for API calls
No per-user authorization is needed with DWD. The service account acts on behalf of the organization, so the scopes configured in your Google Workspace admin console must match the scopes you specify here.
OAuth token expiration
OAuth access tokens expire. For browser OAuth connections, Anter uses the stored refresh token to acquire a new access token automatically when the current one expires — no action needed on your part as long as the authorization remains active.
If the authorization is revoked from the service's side (for example, you revoke Anter's access in your Google account settings), the server's health badge will move to Error or Action needed on the next attempted call. Re-authorize using the Connect Account flow to restore it.