Looking for a connector that is already wired up for you? See MCP connectors for the full list of supported integrations.
Authentication options
When you add a Custom MCP server, an Authentication selector appears above the credential fields. Pick the option that matches how your server expects to be called.API Key
A token DeepMask sends as a standard bearer credential. Also the right choice for servers that need no authentication at all.
Key & Secret
A consumer key and secret forwarded to your server as headers, for servers that run their own OAuth against an upstream API.
OAuth 2.0
DeepMask runs the full OAuth 2.0 flow against endpoints you supply and refreshes tokens for you.
The three modes are mutually exclusive. Switching an existing connector from one mode to another clears the credentials stored for the mode you left.
Option 1 — API Key
Use this when your server accepts a static token, or when it is open and needs no credential at all.Fields
Steps
1
Open the connector form
Go to Connectors, click Add connector, and choose Custom MCP server.
2
Keep Authentication set to API Key
This is the default mode.
3
Enter the server URL and token
Paste your MCP endpoint. Add an API key or token only if your server requires one.
4
Test the connection
Click Test Connection. DeepMask calls your server and reports how many tools it discovered.
5
Save
Click Add Connector. The connector becomes available in your chats.
Option 2 — Key & Secret
Some MCP servers run their own OAuth against an upstream API (a Salesforce-style MCP is the common case) and only need your application’s credentials to do it. In that setup DeepMask does not perform any OAuth itself — it forwards your credentials to the server on every request and lets the server handle the rest.What DeepMask sends
Both values are encrypted at rest. Some servers only need the key, which is why the secret is optional.
Steps
1
Choose Key & Secret
In the Authentication selector, click Key & Secret.
2
Enter your server URL
Paste the MCP endpoint your server exposes.
3
Paste the consumer key and secret
Use the credentials from the application registration your MCP server expects — for example the Consumer Key and Consumer Secret of a Salesforce External Client App.
4
Test and save
Click Test Connection, then Add Connector. The test sends the same headers the connector will use at runtime, so a pass here means your server accepted the credentials.
Option 3 — OAuth 2.0
Choose this when your MCP server is protected by OAuth 2.0 and expects a bearer access token. DeepMask runs the Authorization Code flow with PKCE, stores the resulting tokens encrypted, and refreshes them automatically so you do not have to sign in again. Nothing is baked in for a specific vendor — you supply every endpoint, so this works for any OAuth-protected MCP server.Before you start
Register an OAuth application with your identity provider and set its redirect URI to:Fields
Steps
1
Choose OAuth 2.0
In the Authentication selector, click OAuth 2.0. The form switches to the OAuth credential fields.
2
Fill in the credentials and endpoints
Enter the client ID and secret, the authorization and token URLs, and your scopes. Add the user info URL only if you want the connection labelled with the signed-in account.
3
Enter the MCP server URL
This is your MCP endpoint, not an OAuth endpoint.
4
Continue to the review screen
Click Next. DeepMask shows what happens during the redirect and which permissions are requested before sending you anywhere.
5
Authorize
Click Continue. You are taken to your provider’s sign-in page. Approve the requested scopes.
6
Confirm
You return to DeepMask automatically and the connector shows as connected.
Access follows exactly the scopes you entered. DeepMask does not narrow them to read-only, so request only what your server actually needs.
Server URL requirements
The same rules apply to the MCP server URL and to the OAuth endpoints:- The URL must use
http://orhttps://. - OAuth endpoints must use
https://. - Hosts that resolve to private or internal addresses are rejected, including
localhost, loopback addresses, and private IP ranges. Your MCP server must be reachable from the public internet.
Connection options and the system prompt
Both are optional and available in every authentication mode.- Connection options — when the connector type declares configurable features, they appear as a Connection options section where you choose what to enable.
- System Prompt — free-text instructions attached to this connector. The AI receives them whenever it uses the connector’s tools, which is a good place to describe when the tools should be used or what conventions your server expects.
Testing before you save
For the API Key and Key & Secret modes, DeepMask requires a successful Test Connection before the Add Connector button is enabled. A successful test reports the number of tools discovered on your server. The test is tied to the values currently in the form. Changing the URL, the credentials, the authentication mode, or any connection option clears the result and you have to test again. OAuth connectors skip this gate — your provider’s consent screen is the test.Editing a connector later
Open Connectors, select the connector, and choose Edit.- Secrets are never pre-filled. The API key, consumer key, and consumer secret fields start empty. Leave a field blank to keep the stored value, or type a new value to replace it.
- Switching modes clears the other side. Moving from API Key to Key & Secret removes the stored API key, and moving back removes the stored consumer credentials.
- OAuth connectors show Reconnect instead of Test Connection. Reconnect reuses the credentials and endpoints already on file, so you do not re-enter them — you only sign in again. You re-enter credentials only if you delete the connection and start over.
The authentication mode cannot be switched between OAuth and the non-OAuth modes on an existing connector. To move an API Key connector to OAuth, add a new connector and remove the old one.
Troubleshooting
Test Connection fails with an authorization error
Cause: The server rejected the credential DeepMask sent. Resolution: Confirm you picked the right authentication mode. An API key sent to a server expectingX-Consumer-Key headers will fail, and so will the reverse. Check the token has not expired or been revoked.
”Internal or private IP addresses are not allowed”
Cause: The server URL or an OAuth endpoint resolves to a private, loopback, or link-local address. Resolution: Expose the server on a publicly resolvable hostname. DeepMask cannot reach services that are only addressable inside your network.”OAuth endpoints must use HTTPS”
Cause: The authorization or token URL was entered withhttp://.
Resolution: Use the https:// form of both endpoints.
OAuth sign-in fails with an invalid scope or redirect error
Cause: The scopes you entered are not all granted by your OAuth application, or the registered redirect URI does not match. Resolution: Confirm the application grants every scope you listed, and that its redirect URI is exactlyhttps://chat.deepmask.io/api/user/connectors/oauth/callback with no trailing slash.
The connector worked but now asks for re-authorization
Cause: The refresh token expired or was revoked, or no refresh token was issued because the scopes did not include an offline or refresh scope. Resolution: Open the connector and click Reconnect. If this keeps happening, add an offline or refresh scope to your OAuth application and to the connector’s Scopes field.Tools do not appear after connecting
Cause: The server connected but exposed no tools, or the tool list changed after connecting. Resolution: Run Test Connection again and check the reported tool count. If it is zero, confirm your server responds to the MCPtools/list request.
Security and privacy
API keys, consumer credentials, OAuth client secrets, and tokens are encrypted at rest. DeepMask never shows a stored secret back to you — editing a connector always starts with empty credential fields.