Skip to main content
Some MCP servers (Figma, Notion on certain plans, Google services) use OAuth instead of static API keys. SlackHive supports three OAuth flows depending on the provider.

​
Which MCPs need OAuth

The MCP catalog badges tell you:
  • OAuth - this MCP uses a one-time browser auth flow
  • PAT - this MCP uses a personal access token you paste once
  • API key - this MCP uses an API key in env vars
If a template shows no OAuth badge, you don’t need this page.

​
Flow A - Click Connect (dynamic registration)

Works for providers that support dynamic client registration (Figma, some others):
  1. Open the MCP catalog and pick the template
  2. Click Connect
  3. SlackHive opens the provider’s OAuth consent page
  4. Approve the scopes
  5. The browser redirects back - tokens are stored encrypted
Nothing else to paste. The MCP shows a green “Connected” badge.

​
Flow B - Paste a token

Works for providers that don’t support dynamic registration (most enterprise SaaS):
  1. Open the MCP catalog and pick the template
  2. SlackHive shows a link to the provider’s token-generation page
  3. Open the link, create a token with the scopes the hint shows
  4. Paste the token into the MCP’s auth field
  5. Save
Token refresh isn’t automatic here - re-paste when the token expires.

​
Flow C - Import from Claude Code CLI

If you’ve already authenticated an MCP through the Claude Code CLI, SlackHive can detect and import it:
  1. Open the MCP catalog
  2. Scroll to Detected from Claude Code CLI - you’ll see a list of CLI-authenticated MCPs
  3. Click Add on the one you want - it imports in one click with a CLI badge
No re-auth, no token paste.

​
Token refresh

  • macOS - SlackHive reads the Claude Code Keychain and auto-refreshes OAuth tokens when they expire. On 401 errors, it refreshes once and retries.
  • Linux - reads from secret-tool (GNOME Keyring) on the same path.
  • Other setups - if auto-refresh isn’t available, reconnect manually from the catalog.

​
When Connect fails

  • “Dynamic registration rejected” - the provider doesn’t support it. Switch to Flow B (token paste).
  • “Invalid scopes” - re-generate the token with the exact scopes the hint shows.
  • “Redirect URI mismatch” - check that http://localhost:3001 is allowed in the provider’s app settings.
  • “Token expired” - reconnect from the catalog, or re-paste a fresh token.
See MCP servers for the full catalog behavior.