Customers want to build server-side apps that call Port MCP (https://mcp.port.io/v1) on behalf of individual users, with each call running under that user's own Port identity and permissions.

Today the only way to do this is the authorization_code flow, which means every user has to link their Port account separately.

These customers already sign in to their apps and to Port with an external IdP (e.g. Microsoft Entra ID SSO), so they want a single sign-in to cover both their app and Port.

Request:

Add the urn:ietf:params:oauth:grant-type:token-exchange grant (RFC 8693) to https://mcp.port.io/v1/token (and the US equivalent, mcp.us.port.io).

The client would send an access token issued by a trusted external IdP (e.g. Entra ID) as the subject_token and get back a Port access token for the matching Port user.

Admins would need a way to configure which issuers they trust, the expected audience or scope, and which client registrations are allowed to exchange tokens.

Current behavior:

The token endpoint metadata (/.well-known/oauth-authorization-server) lists only authorization_code, refresh_token and client_credentials.

client_credentials doesn't fit this use case, because it is a machine identity with no per-user permissions.

Related:

There is an existing roadmap idea for token exchange on the Port API: https://roadmap.getport.io/admin/board/ideas/p/token-exchange-mechanism-for-api-authentication

This request is specifically about the MCP server.

Customer: Abu Dhabi Investment Authority (ADIA), org_jRQbsFhFMow9ywPM, EU

Zendesk: https://getport.zendesk.com/agent/tickets/12235