AI Activate - Connecting an MCP client that does not support DCR

Overview

This guide describes how to connect an MCP client that does not support automatic Dynamic Client Registration (DCR) to the Nasuni AI Activate MCP server. You complete a one-time manual registration, then enter the returned Client ID in your client.

Use this guide for:

• Microsoft Foundry. For more information, see AI Activate - Connecting Microsoft Foundry.

• If Dynamic discovery does not complete and you select Manual, use this guide for Microsoft Copilot Studio. For more information, see AI Activate - Connecting Microsoft Copilot Studio.

• Any other MCP client that expects a Client ID that you enter yourself.

You do not need this guide for clients that register themselves automatically, such as Claude, Claude Code, ChatGPT, and Copilot Studio with Dynamic discovery. For those clients, see their guides in AI Activate Integrations.

Background: How OAuth works in this setup

The AI Activate MCP server uses OAuth for security.

Before an OAuth client can authenticate, the client must register with the MCP server. Registration tells the MCP server which redirect URIs the client can use. If a redirect URI is not on the allowlist, the MCP server rejects the redirect URI during authorization.

Dynamic Client Registration (DCR)

DCR is an OAuth feature that lets an MCP client register itself automatically by calling a /register endpoint at connection time. AI Activate supports DCR, so clients with built-in DCR support connect without any manual configuration.

Some clients expect you to register a client ahead of time, meaning you enter a Client ID manually. Before finishing the connection configuration, register the client once. The procedure below is that manual registration.

Manual registration procedure

The manual registration procedure has four steps:

1. Discover the OAuth endpoints from the server metadata.

2. Obtain your client’s redirect URI.

3. Register the client by calling the registration endpoint.

4. Enter the returned Client ID in your client’s configuration.

The sections below provide complete instructions for Step 1 and Step 3, which are the same for every client. Step 2 and Step 4 depend on the client, so also see your client’s guide for the exact fields and screens.

Step 1: Discover the OAuth endpoints

AI Activate publishes its OAuth metadata at a standard well-known URL.

1. Start with your account's MCP endpoint, shown in the Portal under AI Activate → MCP Server. See Get your MCP endpoint.

2. If present, remove the trailing slash and append /.well-known/oauth-authorization-server.

3. Open the resulting URL in a browser to retrieve the metadata. For example:

https://mcp.nasuni.com/.well-known/oauth-authorization-server

Example response:

{
  "issuer": "https://mcp.nasuni.com",
  "authorization_endpoint": "https://account.nasuni.com/authorize",
  "token_endpoint": "https://mcp.nasuni.com/token",
  "jwks_uri": "https://account.nasuni.com/jwks.json",
  "registration_endpoint": "https://mcp.nasuni.com/register",
  "response_types_supported": ["code"],
  "response_modes_supported": ["query"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post", "none"],
  "code_challenge_methods_supported": ["plain", "S256"]
}

Save the response. The values that you need in later steps include the following:

Note: Always use the values from your own metadata response rather than copying the examples above. The values can differ depending on the environment that your account is connected to.

Step 2: Obtain your client’s redirect URI

Every OAuth client has a redirect URI, sometimes called a callback URL. You register the redirect URI with the server in Step 3. Get the redirect URI from your client’s MCP connection configuration.

Clients provide the redirect URI in different ways:

• Some clients display the redirect URI when you start configuring a connection.

• Other clients, such as Microsoft Foundry and Copilot Studio’s Manual option, do not show the redirect URI until you save an initial configuration. For these clients, save the configuration with placeholder values for the Client ID and, if required, the Client Secret. Copy the redirect URI that the client then shows. You replace the placeholders in Step 4.

Before continuing to step 3, obtain the client's final redirect URI. After creation, a registration cannot be changed.

Step 3: Register the client

Make a POST request to the registration endpoint (registration_endpoint) from Step 1, supplying your client’s redirect URI from Step 2.

Replace <registration_endpoint> with the value from Step 1, and <client_redirect_uri> with your client’s actual redirect URI.

curl -X POST <registration_endpoint> \
  -H "Content-Type: application/json" \
  -d '{
    "redirect_uris": ["<client_redirect_uri>"],
    "token_endpoint_auth_method": "none",
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "client_name": "Example MCP Client"
  }'

curl.exe -X POST <registration_endpoint> `
  -H "Content-Type: application/json" `
  -d '{"redirect_uris": ["<client_redirect_uri>"], "token_endpoint_auth_method": "none", "grant_types": ["authorization_code", "refresh_token"], "response_types": ["code"], "client_name": "Example MCP Client"}'

Notes on the request body:

• redirect_uris must contain the exact redirect URI that your client uses. If the value does not match the client’s redirect URI exactly, character for character, the authorization flow fails later.

• Because MCP clients use PKCE as public clients, set token_endpoint_auth_method to none. Even if you request a different method, the server registers the client as public. The registration response still includes a client_secret. Some manually configured clients require a Client Secret in their connection settings. If your client does, use the client_secret from the response.

• client_name is a label for your own reference. Set the client_name to something that identifies the client you are registering.

A successful response is a JSON body containing the new client_id and client_secret:

{
  "client_id": "9e246c84-44e0-4d86-8b8a-9b5a39c94a6e",
  "client_secret": "<client-secret>",
  "redirect_uris": ["https://your-client.example.com/oauth/callback"],
  "client_name": "Example MCP Client",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "require_pkce": true,
  "registration_token": "<registration-token>",
  "token_endpoint_auth_method": "none"
}

The response also includes a registration_token, which you do not need for this procedure. Keep the client_secret and the registration_token private, as you would a password. Whether you need the client_secret depends on your client (see Step 4).

Step 4: Configure the client

In your MCP client, create or edit the MCP connection, and supply the values from Step 1 and Step 3. If you saved placeholder values in Step 2, replace the placeholder values now. Field names differ by client, so also see your client’s guide.

In Copilot Studio, you replace the placeholder values by editing the connector from the Custom connectors list in Power Apps or Power Automate. See the "Edit an MCP connection" section of Microsoft's Connect your agent to an existing Model Context Protocol (MCP) server.

Save the configuration. When prompted, complete the OAuth sign-in. Sign in through Nasuni Portal single sign-on with your organization's company name and your own account.

Notes:

• The server registers the client as a public client that uses PKCE. The registration response includes a client_secret. Some clients require the client_secret (see Step 4), and others do not.

• You cannot change a registration after you create it. Each distinct redirect URI requires its own registration, so if a client’s redirect URI changes, register again to get a new Client ID bound to the new URI, and enter the new Client ID in your client.

• Any MCP client that does not support automatic DCR follows this same procedure. Only Step 2 and Step 4 differ by client.