This guide walks you through connecting your own MCP client — an AI assistant, agent platform, or product feature — to the monday.com hosted MCP server. It covers the authentication options available at each stage and how to register your integration to make it publicly available.

Overview

The hosted MCP server is the recommended way to connect to monday.com. It requires no local setup, updates automatically, and handles all the infrastructure for you.

• Server URL: https://mcp.monday.com/mcp
• Transport: Streamable HTTP
• Auth: OAuth 2.0 or Bearer token with a personal API token

Choosing an authentication path

How you authenticate depends on what you're building:

Personal use and testing: API token

If you're using one of the compatible MCP clients, you don't need a token — add the server URL and authenticate via OAuth when prompted. Use a personal API token when your client isn't a compatible MCP client or doesn't support the MCP OAuth flow — for example, custom scripts, homegrown agents, or tools that only support static Bearer tokens.

For personal use, prototyping, and testing, this is the fastest way to connect. No app or registration is needed.

1. Log in to your monday.com account
2. Click your profile picture in the top-right corner and select Developers
3. Click My access tokens in the left menu
4. Copy your personal access token

Then pass the token as a Bearer token in the Authorization header of your MCP requests:

Authorization: Bearer YOUR_API_TOKEN

For MCP clients that support custom headers, the configuration looks like this:

{
  "mcpServers": {
    "monday-mcp": {
      "url": "https://mcp.monday.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_TOKEN"
      }
    }
  }
}

Personal tokens mirror your UI permissions, so the MCP server can access everything your user can — and nothing more. This is ideal for individual development, but not for integrations used by other people.

⚠️

Warning

Never share your API token or commit it to version control. Rotate tokens regularly, and revoke them when they're no longer needed.

OAuth: create a monday app

If your integration authenticates monday.com users (rather than just yourself), use OAuth. The monday MCP server uses the standard OAuth 2.0 Authorization Code Grant, with monday.com as the identity provider — the same flow used by all third-party integrations with the platform API.

Creating an app is the right path while you're developing a user-facing integration or distributing it privately (for example, inside your own organization). Publicly available integrations authenticate through dynamic client registration instead.

To get OAuth credentials, create an app in the monday.com Developer Center:

Step 1: Create your app

1. Log in to your monday.com account. Click your profile picture in the top-right corner and select Developers to open the Developer Center
2. Click + Create app in the top-right corner
3. Enter an App Name and App Slug, then click Create app

Step 2: Configure OAuth settings

1. In the left sidebar under Build, click OAuth & Permissions
2. On the Scopes tab, select the permission scopes your integration needs
3. Switch to the Redirect URLs tab and add your callback URL — the URL where monday.com sends authorization codes — then click Save

Step 3: Retrieve your credentials

1. Go to General Settings in the left sidebar of your app
2. Scroll down to the App Credentials section and copy your Client ID and Client Secret

❗️

NOTE

Your client secret is a secret. Never share it or add it to source code others can access. You can regenerate it from the app's settings if it's ever compromised.

Authorization flow

The MCP authorization flow follows the standard monday.com OAuth flow:

1. Your MCP client redirects the user to https://auth.monday.com/oauth2/authorize with your client ID
2. The user approves the requested permission scopes
3. Your client exchanges the authorization code for an access token
4. Include the access token in the Authorization header of your MCP requests:

Authorization: Bearer YOUR_ACCESS_TOKEN

All MCP tool calls execute in the context of the authenticated user, scoped to that user's platform permissions. The MCP token doesn't grant any permissions beyond what the user already has in monday.com.

Make your integration publicly available

Step 1: Register your integration

Submit your integration for review using the MCP integration registration form. You'll be asked to provide details about your company, your integration, and how it uses the monday MCP server.

Once approved, your integration can be made available to monday.com users, and may be featured in the compatible MCP clients list.

Step 2: Authenticate with dynamic client registration (DCR)

Publicly available MCP clients don't use a pre-created monday.com app. Instead, they authenticate through OAuth 2.0 Dynamic Client Registration, as defined by the MCP authorization specification: the client registers itself with the MCP server's registration endpoint, then runs the standard authorization code + PKCE flow.

The server publishes its OAuth metadata through standard discovery documents, so MCP-compliant clients handle registration and authorization automatically:

If you're building on an MCP SDK or framework that follows the MCP authorization specification, no additional OAuth setup is required — point your client at https://mcp.monday.com/mcp and the discovery, registration, and authorization flow happens automatically.

Advanced configuration

Specifying an API version

The MCP server executes tool calls against the monday.com GraphQL API. You can pin a specific API version using the Api-Version header:

{
  "mcpServers": {
    "monday-mcp": {
      "url": "https://mcp.monday.com/mcp",
      "headers": {
        "Api-Version": "2026-07"
      }
    }
  }
}

Available tools

The monday MCP server exposes more than 60 tools for reading and writing monday.com data. To view all available tools and their current parameters, use the tools/list MCP command, or browse the Platform MCP tools reference.

The tool set may evolve over time — tools may be added, updated, or deprecated. Use tools/list to ensure your client always has the most up-to-date schemas.

Rate limits

MCP tool calls consume from your account's daily API call limit, just like direct API requests. Keep this in mind for agent-driven workflows that may issue many calls.

Security and permissions

• User-scoped access: All actions taken over MCP appear as the user who authorized them. Access is determined by the authenticated user's monday.com permissions — users can only reach workspaces, boards, and items they already have access to.
• Token security: Store client secrets and all tokens securely (never commit them to version control), use HTTPS for all requests, implement proper token refresh logic, and revoke tokens when they're no longer needed.
• No token storage: The MCP server does not store or log customer OAuth tokens. Token lifecycle management (storage, rotation, revocation) is your responsibility.

For the full security architecture — tenant isolation, AI-layer risks, and OWASP MCP Top 10 alignment — see the MCP security overview.

Common issues

Authentication failures

1. Verify your redirect URL matches exactly in both your app settings and authorization request
2. Ensure your client ID and client secret are correct
3. Check that the requested scopes are enabled on your app's OAuth & Permissions page

Connection issues

1. Verify the MCP server URL is https://mcp.monday.com/mcp
2. Check that you're including a valid access token or API token in the Authorization header
3. Verify the access token hasn't expired

Related resources:

• Compatible MCP clients
• Platform MCP tools reference
• MCP security overview
• OAuth documentation