# MCP on a self-hosted deployment

Connect an MCP client to a self-hosted Nominal deployment. On a Nominal-managed deployment, follow [Nominal MCP](https://dev.nominal.io/quickstart/mcp.md#connect) instead.

Your administrator enables one of two modes, [OAuth](https://dev.nominal.io/quickstart/mcp/quickstart-self-hosted.md#oauth) or [API key](https://dev.nominal.io/quickstart/mcp/quickstart-self-hosted.md#api-key). Ask your administrator which one your deployment uses. In the commands below, replace `<api-host>` with your deployment’s [API host](https://dev.nominal.io/quickstart/mcp.md#your-api-host).

## OAuth

OAuth sign-in works when the deployment’s identity provider is Okta and your administrator has enabled OAuth on the MCP endpoint. [🔒︎Configure AI > External MCP server](https://docs.nominal.io/core/documentation/deployment/ai-setup#external-mcp-server) explains the administrator’s setup.

Set up your client as described in [Nominal-managed setup](https://dev.nominal.io/quickstart/mcp.md#nominal-managed). Your administrator also registers each client’s sign-in callback (redirect URI) on the Okta application, for both `localhost` and `127.0.0.1`. Claude Code and Codex use different callbacks, so tell your administrator which clients you use:

- **Claude Code:** `http://localhost:54545/callback`, the bare `/callback` path.
- **Codex:** `http://localhost:54545/callback/<segment>`. The segment is derived from your MCP server URL and is the same for everyone on your deployment. Compute it before signing in:

  ```bash
  python3 -c 'import hashlib,base64,sys;print(base64.urlsafe_b64encode(hashlib.sha256(sys.argv[1].encode()).digest()[:9]).decode().rstrip("="))' \
    "https://<api-host>/mcp"
  ```

## API key

Create a Nominal API key (see [API Keys Setup](https://dev.nominal.io/quickstart/api-keys-setup.md)). The client sends it on every request as `Authorization: Bearer <your-api-key>`. API key mode needs no client ID or callback port.

**Claude Code**

```bash
claude mcp add nominal --transport http \
  https://<api-host>/mcp \
  --header "Authorization: Bearer <your-api-key>"
```

**Codex**

In `~/.codex/config.toml`:

```toml
[mcp_servers.nominal]
url = "https://<api-host>/mcp"
bearer_token_env_var = "NOMINAL_API_KEY"
```

Then set the API key in the environment Codex runs in:

```bash
export NOMINAL_API_KEY="<your-api-key>"
```

**Other clients**

```json
{
  "mcpServers": {
    "nominal": {
      "url": "https://<api-host>/mcp",
      "headers": {
        "Authorization": "Bearer <your-api-key>"
      }
    }
  }
}
```

If a step fails, see [Troubleshooting](https://dev.nominal.io/quickstart/mcp/troubleshooting.md#self-hosted).