OAuth and MCP applications in an account
The OAuth and MCP applications section contains the settings for connecting external applications to a Planfix account.
Open Account management → API → OAuth and MCP applications. This section is available to account administrators and technical administrators.
It contains three areas:
- MCP — the MCP server address and brief connection instructions;
- Applications owned by this account — OAuth applications created specifically for the current account;
- Third-party applications — the general policy and applications explicitly approved in the account.
MCP
This area displays the Planfix MCP URL:
https://mcp.planfix.com/mcp
A user normally only needs to add this URL to a compatible MCP client and complete OAuth sign-in. The account name is selected on the Planfix page and is not included in the URL. See Planfix MCP for step-by-step instructions.
Applications owned by this account
Create an account-owned application when the integration is intended only for the current account and the external client needs a predefined client_id.
An account-owned application:
- cannot connect to other accounts;
- is available in its owner account regardless of the third-party application policy;
- uses the global OAuth endpoints;
- can work with the REST API or MCP within its selected scopes.
Creating an application
- Select Create application.
- Enter a clear name and description.
- Select the OAuth client type.
- Add the client's redirect URIs.
- Select the minimum required access levels.
- Save the application and copy the generated credentials.
| Client type | When to use it |
|---|---|
| Public | A mobile, desktop, or browser application, or a local MCP client. No secret is issued; PKCE protects the authorization flow. |
| Confidential | A server-side application that can store a client secret securely. Never include the secret in client-side code, a mobile application, or a distributed configuration file. |
The client secret is displayed after a confidential application is created. Store it in a secure secrets manager.
Redirect URIs and permissions
Use https for regular web applications. http is allowed only for loopback hosts such as localhost and 127.0.0.1.
Select only the scopes required by the integration. Scopes limit application access but do not extend the permissions of the user who connects it.
Changing redirect URIs or scopes changes the application's approval version, and previously issued tokens no longer match the application. Users will need to connect again.
Managing an application
From the application card, you can:
- edit the name, description, redirect URIs, and scopes;
- disable and re-enable the application;
- rotate the client secret of a confidential client.
After secret rotation, the previous client secret stops working immediately. Copy the new secret and update the integration's server configuration.
Disabling an application blocks authorization and the use of its issued tokens. Before disabling it, make sure no business processes depend on it.
Third-party applications
Third-party applications include partner-owned applications, published applications, and MCP clients registered through CIMD or DCR.
Third-party application policy
| Policy | Result |
|---|---|
| Allow published applications | Applications published by Planfix are available without separate approval. Private partner applications and automatically registered MCP clients still require explicit administrator approval. |
| Approved applications only | Every third-party application requires explicit administrator approval. |
| Block third-party applications | Third-party OAuth and MCP applications are blocked. Applications owned by the account continue to work. |
Approved applications only is recommended for accounts where every integration must be reviewed individually.
Approving an application
An approval request can appear in two ways:
- a user starts an OAuth connection and Planfix reports that approval is required;
- a partner sends an administrator a direct link to the application.
Before approving an application, verify:
- its name, description, and owner;
- its redirect URI or callback host;
- the requested scopes;
- whether employees need the integration.
Administrator approval applies to the account but does not automatically connect every user. Each employee signs in separately and consents on their own behalf. If an administrator is connecting the application, Approve and connect completes both actions.
If the developer changes the redirect URIs or scopes of a third-party application, the new version must be approved.
Revoking approval
To block an application for the account, find it in the approved list and revoke access. The associated OAuth tokens for users in this account are revoked.
When the policy is Allow published applications, revoking an explicit approval does not block a published application because the general policy still allows it. Select Approved applications only or Block third-party applications to block it.
Personal user connections
Account approval and an individual user's connection are separate levels of control.
An employee can view and revoke their own OAuth connections:
- Open your user card.
- Go to Session management.
- Find the application; MCP connections are marked MCP.
- Delete the session.
Deleting the session revokes the associated tokens. To restore access, the user must complete OAuth authorization again.
Recommendations for administrators
- Use Approved applications only if every integration must be reviewed separately.
- Verify the application owner and redirect URI, not only its name.
- Approve the minimum required scopes, especially for modifying and deleting data.
- Review the third-party application list periodically and remove unused applications.
- Use the public client type for local and desktop clients and the confidential type for server-side integrations.
- If a confidential application's credentials may be compromised, rotate its secret immediately and reconnect the integration if necessary.