A personal API token or an OAuth app is enough for personal use, internal tools, and testing. To distribute your MCP integration publicly — as a product feature, marketplace listing, or partner integration available to monday.com users — you must register it with monday.com and authenticate through dynamic client registration (DCR).

🚧
Registration is required for public availability. Skip this guide if you're only building for yourself or your organization — use an API token or your own OAuth app instead.

Step 1: Register your integration

Submit your integration for review using the MCP integration registration form. You'll be asked to provide details about your company, your integration, and how it uses the monday MCP server.

Once approved, your integration can be made available to monday.com users, and may be featured in the compatible MCP clients list.

Step 2: Authenticate with dynamic client registration (DCR)

Publicly available MCP clients don't use a pre-created monday.com app. Instead, they authenticate through OAuth 2.0 Dynamic Client Registration, as defined by the MCP authorization specification: the client registers itself with the MCP server's registration endpoint, then runs the standard authorization code + PKCE flow.

The server publishes its OAuth metadata through standard discovery documents, so MCP-compliant clients handle registration and authorization automatically:

Endpoint	URL
Protected resource metadata	`https://mcp.monday.com/.well-known/oauth-protected-resource`
Authorization server metadata	`https://mcp.monday.com/.well-known/oauth-authorization-server`
Client registration	`https://mcp.monday.com/register`
Authorization	`https://mcp.monday.com/authorize`
Token	`https://mcp.monday.com/token`

If you're building on an MCP SDK or framework that follows the MCP authorization specification, no additional OAuth setup is required — point your client at https://mcp.monday.com/mcp and the discovery, registration, and authorization flow happens automatically.

Step 3: User authorization (OAuth consent)

When a user connects your MCP client to monday.com, your client opens the monday.com OAuth authorization screen. The user reviews the connection and clicks Authorize to grant access.

The consent screen shows your client name, a short description of the connection, and that the client inherits the user's existing monday.com permissions.

After the user authorizes:

monday.com redirects back to your client with an authorization code
Your client exchanges the code for an access token (and refresh token, if issued) via the token endpoint
Your client includes the access token in the Authorization header of subsequent MCP requests:

Authorization: Bearer YOUR_ACCESS_TOKEN

All MCP tool calls then run as that user, scoped to their monday.com permissions and any MCP access limits set by the account admin — for example, restricting MCP to specific workspaces only.

Related resources: