This article covers creating Client ID/Secret credentials for an integration user in Integration Center, and using them to connect an MCP client or your own code to Recorded Future MCP.
You don't always need credentials. Claude, ChatGPT, Cursor and VS Code register themselves with Recorded Future when you add the server URL, and each person signs in with their own Recorded Future account. For that path, see Connecting to Recorded Future MCP.
Eligibility: Integration users are available to customers whose package includes unlimited integration users. If yours doesn't, you can still connect to Recorded Future MCP with your individual Recorded Future user until the end of 2026. See Connecting to Recorded Future MCP.
Connection values
MCP clients ask for some of these values when you set up a connection with a Client ID and Client Secret. Field names vary between clients, so common alternatives are given in brackets.
| Setting | Value |
|---|---|
| MCP server URL | https://mcp.recordedfuture.com/mcp |
| Transport | Streamable HTTP |
| Authorization URL (Auth URL, authorization endpoint) | https://id.recordedfuture.com/authorize |
| Token URL (token endpoint) | https://id.recordedfuture.com/token |
| Refresh URL |
https://id.recordedfuture.com/token, the same as the Token URL |
| Scopes | openid email profile offline_access |
| Client authentication | Client ID and Client Secret sent in the request body (client_secret_post) |
| PKCE | Supported (S256) |
| Resource (audience) | https://mcp.recordedfuture.com/mcp |
| Authorization server (issuer) | https://id.recordedfuture.com/ |
Separate the scopes with spaces, unless your client asks for commas. Include offline_access. Without it, the client gets no refresh token and the connection stops working when the access token expires.
Clients that read OAuth settings automatically use these metadata addresses:
- Protected resource metadata:
https://mcp.recordedfuture.com/.well-known/oauth-protected-resource/mcp - Authorization server metadata:
https://id.recordedfuture.com/.well-known/openid-configuration
Choose how your client signs in
A Client ID and Client Secret can be used in two ways, dependent on the client.
| Browser sign-in | No browser (client credentials) | |
|---|---|---|
| Use it for | AI assistants that open a Recorded Future sign-in page, such as Microsoft Copilot Studio, Microsoft Security Copilot, and ChatGPT or Claude set up with a Client ID | Your own code: backend services, scheduled jobs, CI steps and agents that run unattended |
| Your client asks for | Client ID, Client Secret, Authorization URL, Token URL, Refresh URL and scopes | Client ID, Client Secret and Token URL |
| Someone signs in | Yes, once, in the browser. The client then refreshes the token itself. | No |
| Redirect URI | Must be added to the Client ID | Not used |
| Steps | Step 3a | Step 3b |
If your client's setup form has an Authorization URL field, or it opens a Recorded Future sign-in page, it uses browser sign-in.
Step 1: Create an integration user
- In the Recorded Future portal, go to Integration Center.
- Open the Recorded Future MCP tile.
- Create a new integration user and select the entitlements it needs. Tools follow entitlements: an integration user without Vulnerability Intelligence does not see Vulnerability Intelligence tools.
- Select the authentication type Client ID/Secret (OAuth 2.0).
- Generate the credentials.
Step 2: Save your Client Secret
Recorded Future shows the Client Secret once, when you create it. Copy it to a password manager or secrets store. Recorded Future cannot show it to you again. If you lose it, revoke the credential and generate a new one from the same tile.
Step 3a: Browser sign-in
Add your client's redirect URI
After someone signs in, Recorded Future sends the browser back to your MCP client at the client's redirect URI. Recorded Future accepts only redirect URIs that are registered to your Client ID. A new Client ID has none, so sign-in fails with "Parameter redirect_uri is invalid" until you add one.
| Client | Redirect URI |
|---|---|
| Claude | https://claude.ai/api/mcp/auth_callback |
| ChatGPT | https://chatgpt.com/connector_platform_oauth_redirect |
| Microsoft Security Copilot | https://securitycopilot.microsoft.com/auth/v1/callback |
| Microsoft Copilot Studio | Shown as the callback URL after you save the MCP tool. Copy it from there. |
| Other clients | Read it from the browser address bar when the error appears. See Troubleshooting: "Parameter redirect_uri is invalid". |
You must be an enterprise administrator to add a redirect URI.
- In Integration Center, open the Recorded Future MCP tile.
- Edit your integration user.
- Find the credential that has your Client ID and select Add Redirect URI.
- Paste the redirect URI and select Save.
CAUTION: Copy and paste the redirect URI. A small difference, such as an extra
/at the end, causes a sign-in error.
If you connect more than one client with the same Client ID, add each client's redirect URI.
Enter the values in your client
- In your client, choose OAuth 2.0 and the option for entering your own client details. Clients call this manual setup, an existing client or a custom app.
- Enter your Client ID and Client Secret.
- Enter the Authorization URL, Token URL, Refresh URL and scopes from the connection values table at the top of this article.
- Save, then sign in when the Recorded Future sign-in page opens.
For the exact fields in each client, see the client setup guides listed below.
Step 3b: No browser (client credentials)
Your code requests an access token from the Token URL, then sends the token with every request to the MCP server. There is no sign-in page and no redirect URI.
Request a token:
curl -X POST https://id.recordedfuture.com/token \ -H "Content-Type: application/x-www-form-urlencoded" \ -d grant_type=client_credentials \ -d client_id=<YOUR_CLIENT_ID> \ -d client_secret=<YOUR_CLIENT_SECRET> \ -d resource=https://mcp.recordedfuture.com/mcpThe response contains an access_token. You don't need to send a scope: the integration user's entitlements decide which tools it can call. This flow returns no refresh token, so request a new token when the current one expires.
Send the token in the Authorization header on every request to https://mcp.recordedfuture.com/mcp:
Authorization: Bearer <ACCESS_TOKEN>For an MCP client that accepts a header, the configuration looks like this:
{ "mcpServers": { "recorded-future": { "url": "https://mcp.recordedfuture.com/mcp", "headers": { "Authorization": "Bearer <ACCESS_TOKEN>" } } }}A token in a static header stops working when it expires. Use a static header for testing. For anything that runs for longer, have your code request a new token before the old one expires.
Step 4: Check the connection
Ask your client:
Which Recorded Future user and organisation am I connected as?
The client calls the whoami tool and returns the Recorded Future user and organisation the connection uses. From your own code, call tools/list to see the tools available to the integration user.
Client setup guides
- Claude: Connecting to Recorded Future MCP
- ChatGPT: Connecting Recorded Future MCP to ChatGPT
- Microsoft Copilot Studio: Microsoft Copilot - Recorded Future MCP Setup Guide
- Microsoft Security Copilot: Connect Microsoft Security Copilot to Recorded Future MCP
Frequently asked questions
Which sign-in method does my client use? If its setup form has an Authorization URL field, or it opens a Recorded Future sign-in page, it uses browser sign-in (Step 3a). If you are writing code that runs without a person present, use client credentials (Step 3b).
Do I need a Client ID to use Claude or ChatGPT? No. Both register themselves with Recorded Future when you add the server URL, and each person signs in with their own account. Use a Client ID only if your organisation wants these clients to use a credential it manages in Integration Center.
Can I use an API key instead? No. Integration users for Recorded Future MCP use Client ID/Secret (OAuth 2.0) credentials. If your client accepts only a static header, use the token from Step 3b. The token expires, so this suits testing.
Which tools can an integration user call? The tools its entitlements cover. Tool calls are authorised against the Recorded Future identity the connection uses. Scope each integration user to the modules its agent needs.
I lost my Client Secret. Revoke the credential in Integration Center and generate a new one. Update the Client ID and Client Secret in every client that uses them. If the Client ID changed, add the redirect URIs to the new Client ID.
Sign-in works, but my client returns "unauthorized" errors. The Client Secret may be wrong or revoked. Check that the Client ID and Client Secret belong to the same credential, or generate a new credential.
How many API calls does a tool call use? One tool call counts as one API call against your allowance. Usage is tracked automatically and shown in Integration Center. See Recorded Future MCP Entitlement & Quota.
Getting help
- Connection and credential problems: Recorded Future Support. Include your Client ID, the client you use and the error text.
- Eligibility and packaging questions: your Recorded Future account team
CAUTION: Don't send your Client Secret to Recorded Future Support.
Related articles
- Recorded Future MCP Overview
- Connecting to Recorded Future MCP
- Troubleshooting: "Parameter redirect_uri is invalid" error for Recorded Future MCP
- Recorded Future MCP: Available Tools
- Recorded Future MCP Entitlement & Quota
This content is confidential. Do not distribute or download content in a manner that violates your Recorded Future license agreement. Sharing this content outside of licensed Recorded Future users constitutes a breach of the terms and/or agreement and shall be considered a breach by your organization.