# OAuth provider

Outline can act as an OAuth provider, to allow for secure integration with internal and external tools with scoped authentication without the need for manual management of API keys.

# Config

## Dynamic Client Registration

To support [MCP](/doc/927ff810-4f96-4887-b635-b65a2087634d) clients, the in-built OAuth server also supports dynamic client registration (DCR), this allows the automatic creation of clients *without* user authentication to support local tools such as Cursor and Claude.

In self-hosted environments, if you would prefer to disable this for security – it can be done so by setting the environment variable:

```bash
OAUTH_DISABLE_DCR=true
```

## Other configuration

* `OAUTH_PROVIDER_ACCESS_TOKEN_LIFETIME` – The number of seconds access tokens issue by the OAuth provider are valid, defaults to 1 hour.
* `OAUTH_PROVIDER_REFRESH_TOKEN_LIFETIME` – The number of seconds refresh tokens issue by the OAuth provider are valid, defaults to 30 days.
* `OAUTH_PROVIDER_AUTHORIZATION_CODE_LIFETIME` – The number of seconds authorization codes issue by the OAuth provider are valid, defaults to 5 minutes.

---

**Documents**

- [License restrictions](https://docs.getoutline.com/s/hosting/doc/license-restrictions-f9aq6uEL3H)
- [Requirements](https://docs.getoutline.com/s/hosting/doc/requirements-ULdYnwi4wG)
- [Installation methods](https://docs.getoutline.com/s/hosting/doc/installation-methods-pSvgz9j0QC)
- [Configuration](https://docs.getoutline.com/s/hosting/doc/configuration-509J4lAzjo)
- [Business + Enterprise](https://docs.getoutline.com/s/hosting/doc/business-enterprise-rv0715NxO3)
- [Backups](https://docs.getoutline.com/s/hosting/doc/backups-KZtPOADCHG)
- [Troubleshooting](https://docs.getoutline.com/s/hosting/doc/troubleshooting-HXckrzCqDJ)