← Back to Blog
tutorialauthenticationgithubsecurity

GitHub OAuth: Authentication for MCPM Explained

How mcpm uses GitHub OAuth for authentication, managing tokens, and securing your publishing workflow.

·3 min read·xapable

GitHub OAuth: Authentication for MCPM Explained

mcpm uses GitHub OAuth — no new account, no new password. This guide explains how authentication works and how to manage it.

Why GitHub OAuth?

  • No new account — use your existing GitHub identity
  • No password to remember — one-click auth
  • Secure — industry-standard OAuth 2.0
  • Your tools stay yours — publishing is tied to your GitHub profile

First-Time Login

mcpm-dev login

What happens:

  1. Your browser opens to https://www.mcpm.dev/cli-login
  2. GitHub asks you to authorize mcpm
  3. You click "Authorize"
  4. A CLI token is generated and stored locally
  5. You're authenticated!

What mcpm Accesses

mcpm requests minimal GitHub permissions:

  • Read your public profile — name, avatar, username
  • Read your email — for account identification only

mcpm cannot:

  • Access your private repos
  • Modify anything on GitHub
  • See your GitHub credentials

Token Management

Where Tokens Are Stored

  • macOS/Linux: ~/.mcpm/auth.json
  • Windows: %USERPROFILE%\.mcpm\auth.json

Check Token Status

mcpm-dev <span class="hljs-built_in">whoami</span>

Output:

Logged in as: xapable
Token expires: August 7, 2026

Token Expiry

Tokens are valid for 30 days. The CLI warns you 7 days before expiry:

⚠️  Your mcpm token expires in 6 days. Run `mcpm-dev login` to refresh.

Refreshing Your Token

mcpm-dev login

This generates a fresh 30-day token. Your old token is invalidated.

Logging Out

mcpm-dev <span class="hljs-built_in">logout</span>

This removes your token locally. Your published packages remain on mcpm.

Multiple Machines

You can be logged in on multiple machines simultaneously. Each gets its own token.

<span class="hljs-comment"># On your laptop</span>
mcpm-dev login

<span class="hljs-comment"># On your desktop</span>
mcpm-dev login

Both tokens work independently.

CI/CD Authentication

For automated publishing (GitHub Actions, etc.):

  1. Generate a token via the web: https://www.mcpm.dev/settings/tokens
  2. Store it as a secret in your CI:
<span class="hljs-comment"># .github/workflows/publish.yml</span>
<span class="hljs-bullet">-</span> <span class="hljs-attr">name:</span> <span class="hljs-string">Publish</span> <span class="hljs-string">to</span> <span class="hljs-string">mcpm</span>
  <span class="hljs-attr">run:</span> <span class="hljs-string">mcpm-dev</span> <span class="hljs-string">publish</span>
  <span class="hljs-attr">env:</span>
    <span class="hljs-attr">MCPM_TOKEN:</span> <span class="hljs-string">${{</span> <span class="hljs-string">secrets.MCPM_TOKEN</span> <span class="hljs-string">}}</span>

Troubleshooting

Problem Solution
"Browser didn't open" Use mcpm-dev login --no-browser for a manual URL
"Token invalid" Token expired — run mcpm-dev login
"Permission denied" You may be using a different GitHub account
"Rate limited" Wait a few minutes — GitHub enforces rate limits

Security Best Practices

  • Don't share tokens — they're like passwords
  • Use CI tokens for automation — not your personal token
  • Logout on shared machines — mcpm-dev logout
  • Revoke tokens anytime — https://www.mcpm.dev/settings/tokens

GitHub OAuth means one less password to manage. Secure, simple, fast.

#MCP #Tutorial #GitHub #Authentication #mcpm

← Back to all posts