---
title: "EZGH apps and MCP clients"
description: "Put EZGH products in your portal, and how MCP clients sign in to EZGH products through your directory."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# EZGH apps and MCP clients

EZGH products with end users get them from EZGH SSO: your directory's people sign in at your
portal, and IAM decides what they may do in the product. The first will be MCP Central, EZGH's MCP
gateway.

> **Note**
>
> MCP Central isn't available yet, and no EZGH product accepts directory users until it launches.
>
> - **In your directory now:** `ezgh` applications (a portal tile and the lifetime of the product's
> tokens), and the OAuth flow for MCP clients described below: client ID metadata documents,
> client registration, consent and EZGH resource tokens.
> - **Coming with MCP Central:** the product itself, which accepts directory users and tells MCP
> clients where your directory is, and its managed policy for directory users.
>
> Until MCP Central launches, the flow can't complete: a client's request for an EZGH resource is
> refused (`invalid_target`). Policies can't be attached to directory users and groups yet either
> (see [Access control](/sso/access-control#iam-for-directory-users)).

## EZGH applications

An `ezgh` application is a portal tile for an EZGH product, and the settings for that product's
tokens:

```json
{
  "name": "MCP Central",
  "kind": "ezgh",
  "ezgh": { "product": "mcpcentral", "launchUrl": "https://mcpcentral.ezghcloud.com/", "resourceTokenLifetimeSeconds": 3600 }
}
```

| `ezgh` field | Description | Default |
| --- | --- | --- |
| `product` | The EZGH product: `mcpcentral` (MCP Central), or `console` for the console application (see [Console access](/sso/console-access)). Can't change. | Required |
| `launchUrl` | The tile's link: an https URL under the product's URL (`https://mcpcentral.ezghcloud.com/…`). `null`: no tile. | `null` |
| `resourceTokenLifetimeSeconds` | How long the product's resource tokens last: 300 to 3,600. | 3,600 |

The console application, with `product` `console`, has its own settings: see
[Console access](/sso/console-access#the-console-application).

The tile shows the product's own mark, or a [logo](/sso/applications#tile-logo) you upload
instead.

[Assign](/sso/assignments) users and groups to choose who sees the tile. Assignments don't give
access to the product: what a directory user may do in an EZGH product comes from IAM policies
attached to them or their groups. See [Access control](/sso/access-control).

## MCP clients

MCP clients, such as Claude Code, sign in to EZGH products through your directory: it's the only
place an interactive MCP client signs in to EZGH Cloud. The client finds your directory's issuer
from the product (once MCP Central launches), then runs OAuth at `https://<alias>.sso.ezgh.app`:

1. **The client identifies itself** with a client ID metadata document (its `client_id` is an
   https URL of its metadata), or registers at [`/oauth2/register`](/sso/oidc-endpoints#registration)
   (RFC 7591: public clients only, no secret; limited to 20 registrations an hour per IP address).
2. **It asks for one resource:** authorization code with PKCE (`S256`), scope `mcpcentral:connect`, and
   `resource` (RFC 8707), the URL of what it connects to, such as your organization's MCP Central
   endpoint.
3. **The person signs in** at your portal if they aren't already, and **approves** on a consent
   page that names the client, where it returns and the resource. They're asked every time.
4. **The client gets an EZGH resource token** (`ezgh_sat_…`, opaque) for that resource only, and a
   refresh token. Both are used like any credential, and checked by IAM on every request.

| Token | Lifetime |
| --- | --- |
| Resource token | The product's `resourceTokenLifetimeSeconds` (the shortest, if several `ezgh` applications name the product), or 1 hour without one |
| Refresh token | Rotated on every use; 30 days without use, 90 days at most |

Signing out of the portal doesn't end an MCP client's access. Suspending, deleting or resetting
the user's factors does, and so does [RevokeSessions](/sso-api/RevokeSessions/) for that
user. The client can revoke its own tokens at [`/oauth2/revoke`](/sso/oidc-endpoints#revocation).

Source: https://docs.ezghcloud.com/sso/ezgh-apps/index.mdx