1. MCP server
Astravue docs
  • Getting started
    • Introduction
    • Authentication
    • Make your first request
  • General
    • Key concepts
    • Pagination and filtering
    • Errors
    • Dates and times
  • Modules
    • Spaces and projects
    • Tasks
    • Subtasks and checklists
    • Custom fields
    • Comments
    • Time tracking
    • Bulk export
  • MCP server
    • Overview
    • Get started
    • Supported tools
    • Security
    • Build your own client
Guides
API Docs
Guides
API Docs
MCP Server
Astravue MCP on GitHub
  1. MCP server

Authentication & Security

Learn how Astravue MCP authenticates your AI client and keeps your workspace secure.

How authentication works#

Astravue MCP uses OAuth 2.0 Authorization Code Flow with PKCE — the same secure standard used by Google, GitHub, and Slack integrations.
1
Your AI client requests access
When you add Astravue MCP to your client, it generates a secure one-time code challenge (PKCE) and redirects you to the Astravue sign-in page in your browser.
2
You sign in and approve
You log in with your Astravue account and click Approve. Astravue issues an authorization code to your AI client.
3
Your client receives a token
Your AI client exchanges the authorization code for an access token and refresh token. All future requests use the access token.
You only need to sign in again if the refresh token expires or access is revoked.
INFO
Your Astravue password is never shared with your AI client.
The AI client only receives a scoped access token issued through OAuth.

Authorization flow#

Token lifecycle#

TokenLifetimePurpose
Access token30 minutesAuthorizes every MCP tool call
Refresh tokenUp to 30 daysIssues a new access token silently
When an access token expires, your AI client automatically uses the refresh token to obtain a new one.
INFO
Astravue uses refresh token rotation.
Each refresh request issues a new refresh token and invalidates the previous one.

What the AI client can access#

Access is determined entirely by your Astravue account permissions.
The AI can only:
Read and modify data your account already has access to
Perform actions allowed by your workspace role (member, admin, owner)
Access projects where you are a member
TIP
To limit what an AI assistant can access, adjust your workspace role or project memberships rather than modifying the MCP connection.

Disconnecting an AI client#

You can remove Astravue MCP from your AI client at any time.
WARNING
Disconnecting removes the stored tokens from your AI client.
The access token remains valid until it expires (up to 30 minutes) but your client can no longer use it.
To disconnect:
1.
Open your AI client settings
2.
Locate the Astravue MCP server connection
3.
Remove or disable the server entry
Your client will no longer be able to execute any MCP tools.

Security best practices#

Use project-scoped connections when sharing config files
Review AI actions before approving in shared workspaces
Revoke access when offboarding team members
Never share access tokens

Data in transit#

Security FeatureDetails
EncryptionTLS 1.2+ encryption for all traffic
Authorization headerAuthorization: Bearer <access_token>
Data storageMCP server does not store workspace content

Single Sign-On (SSO)#

If your organization uses SSO, the Astravue MCP OAuth flow automatically redirects through your identity provider.
No additional configuration is required.
Users simply authenticate with their SSO credentials when connecting their AI client.
For enterprise SSO setup, contact support@astravue.com.
Modified at 2026-11-10 17:10:34
Previous
Supported tools
Next
Build your own client
Built with