Regarding authentication for Service MCP in Pega 26, does it support only the OAuth 2.0 Authorization Code grant type, or are other OAuth 2.0 grant types, such as Client Credentials, also supported?
Client Credentials are supported. I’ve built this demo with Client Credentials.
Thanks for your reply. I went through the documentation, but my scenario is slightly different. It involves an external agent consuming the Service MCP exposed by Pega, rather than communication between two Pega applications or instances.
I tested this using GitHub Copilot in VS Code and a few other MCP-compatible external agents. They all prompt for authorization using the OAuth 2.0 Authorization Code grant, rather than the Client Credentials grant.
Yes, Pega supports both Client Credentials and Authorization Code grant types. My earlier response was specifically addressing your question about Client Credentials support. For external MCP clients such as GitHub Copilot, Claude, and similar tools, the determining factor is often which OAuth flows the MCP client supports. The Pega MCP examples for external AI clients use OAuth 2.0 Authorization Code flow with a Public Client, Redirect URI, and user authentication through Pega. If your MCP client only supports Authorization Code, you can configure the Pega OAuth 2.0 Client Registration accordingly and use that flow. Client Credentials support in Pega is available, but it can only be used when the consuming MCP client supports machine-to-machine authentication.
I have experienced , as @RameshSangili mentioned, it depends on the client calling the service.