{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Fin MCP connectors","projectTitle":"Intercom and Fin Developer Platform","description":"Faster resolutions, higher CSAT, and lighter support volumes with the only platform to combine the power of automation and human customer support.","siteUrl":"https://developers.intercom.com","image":"/assets/og-image.9c9ef3a6cedbceee0e1d52fae2ffcce97f5a189639cf24e473331da9ad02c5f8.b1bff462.png"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"fin-mcp-connectors","__idx":0},"children":["Fin MCP connectors"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Fin can call tools on your MCP server through a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.intercom.com/help/en/articles/11461635-add-mcp-connectors-for-popular-apps-or-custom-mcps"},"children":["custom MCP connector"]},". This page describes how Intercom appears to your server and its authorization server, so you can allowlist it. For the IP ranges Fin calls from, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/build-an-integration/learn-more/ip-allowlisting/"},"children":["Intercom IP addresses"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-intercom-identifies-itself-as-an-oauth-client","__idx":1},"children":["How Intercom identifies itself as an OAuth client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a teammate connects a custom MCP connector that uses OAuth, Intercom acts as a public OAuth client and completes the authorization code flow with PKCE, as described in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization"},"children":["MCP authorization specification"]},". Intercom identifies itself in one of two ways, in the order the specification gives:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID Metadata Document."]}," Intercom uses a fixed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]},", the URL of a document that describes the client as defined in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document"},"children":["Client ID Metadata Document draft"]},", when all of the following hold: your authorization server metadata advertises ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id_metadata_document_supported: true"]},", its ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["issuer"]}," matches the URL the metadata was served for, and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_endpoint_auth_methods_supported"]}," (if present) includes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["none"]},". The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," is the same for every workspace in a region, so you can allowlist it. If any of these conditions is not met, Intercom falls back to Dynamic Client Registration."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Dynamic Client Registration."]}," Otherwise Intercom registers a new client with your server through ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.rfc-editor.org/rfc/rfc7591"},"children":["Dynamic Client Registration"]}," each time a teammate connects or re-authorizes a connector, and the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," is the one your server issues. Intercom sends no initial access token, so your registration endpoint must accept a public client with the redirect URI for the region."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Available on request"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Identification with a Client ID Metadata Document is enabled per workspace on request. If your authorization server supports it, the owner of the Intercom workspace (your customer) can ask their Intercom contact or Intercom Customer Support to turn it on. Until it is enabled for a workspace, Intercom connects from that workspace through Dynamic Client Registration, so keep registration available. You can tell which mode a connection used from the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," in the authorization request: it is the document URL below when the workspace is enabled, and an identifier your server issued otherwise."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"client-ids-and-redirect-uris-by-region","__idx":2},"children":["Client IDs and redirect URIs by region"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," and the redirect URI depend on the region the Intercom workspace is hosted in. The workspace URL tells you the region: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app.intercom.com"]}," is US hosted, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app.eu.intercom.com"]}," is EU hosted and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app.au.intercom.com"]}," is AU hosted."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Region"},"children":["Region"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"client_id"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Redirect URI"},"children":["Redirect URI"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["US"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.intercom.com/mcp/oauth/client-metadata"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.intercom.com/auth/mcp/callback"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["EU"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.eu.intercom.com/mcp/oauth/client-metadata"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.eu.intercom.com/auth/mcp/callback"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AU"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.au.intercom.com/mcp/oauth/client-metadata"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.au.intercom.com/auth/mcp/callback"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you serve customers in more than one region, allowlist each region's pair separately. A region's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," only ever presents its own redirect URI. The redirect URI is the same in both identification modes, so you can allowlist it today; only the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," depends on the mode."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," URL serves the metadata document itself. It contains at least ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," (the URL), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_name"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Intercom MCP Client"]},"), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_uri"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uris"]}," (the redirect URI for its region), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grant_types"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_code"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]},"), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_types"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]},") and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_endpoint_auth_method"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["none"]},"), and may carry other fields registered for RFC 7591 such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["logo_uri"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_uri"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tos_uri"]},". Treat the fetched document as authoritative; it is served with a one-hour cache lifetime."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-your-mcp-server-and-authorization-server-need-to-support","__idx":3},"children":["What your MCP server and authorization server need to support"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Discovery."]}," Your MCP server should publish OAuth 2.0 Protected Resource Metadata (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.rfc-editor.org/rfc/rfc9728"},"children":["RFC 9728"]},") naming your authorization server in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_servers"]},"; Intercom uses the first entry. If there is no such document, Intercom treats the MCP server URL as the authorization server. The authorization server should publish OAuth 2.0 Authorization Server Metadata (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.rfc-editor.org/rfc/rfc8414"},"children":["RFC 8414"]},") or OpenID Connect Discovery metadata so Intercom can find the authorization and token endpoints, and the registration endpoint if you rely on Dynamic Client Registration. Intercom needs this metadata to use the Client ID Metadata Document. If no metadata is found, Intercom falls back to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/token"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/register"]}," under your MCP server URL with Dynamic Client Registration."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization code flow with PKCE (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["S256"]},") for a public client."]}," Intercom sends ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," in the body of the token request and never a client secret. Issue a refresh token if you want the connection to outlive the access token; Intercom uses the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}," grant."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resource"]}," parameter."]}," Intercom sends the MCP server URL the teammate entered as the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.rfc-editor.org/rfc/rfc8707"},"children":["RFC 8707"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resource"]}," parameter on both the authorization request and the token request. Accept or ignore it, and if you bind tokens to an audience, expect that exact URL."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Scopes."]}," Intercom requests the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," from your MCP server's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["WWW-Authenticate"]}," challenge if there is one, otherwise ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scopes_supported"]}," from the Protected Resource Metadata, otherwise every scope in the authorization server's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scopes_supported"]},". To control what Intercom asks for, return a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," in the challenge or list the minimal set in the Protected Resource Metadata."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["iss"]}," parameter"]}," (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.rfc-editor.org/rfc/rfc9207"},"children":["RFC 9207"]},"). When Intercom identifies itself with the Client ID Metadata Document, it compares any ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["iss"]}," in the authorization response with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["issuer"]}," from your authorization server metadata (exact string match) and fails the connection on a mismatch. A missing ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["iss"]}," fails the connection only if you advertise ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_response_iss_parameter_supported: true"]},". When Intercom used Dynamic Client Registration, a mismatch does not fail the connection."]}]}]},"headings":[{"value":"Fin MCP connectors","id":"fin-mcp-connectors","depth":1},{"value":"How Intercom identifies itself as an OAuth client","id":"how-intercom-identifies-itself-as-an-oauth-client","depth":2},{"value":"Client IDs and redirect URIs by region","id":"client-ids-and-redirect-uris-by-region","depth":2},{"value":"What your MCP server and authorization server need to support","id":"what-your-mcp-server-and-authorization-server-need-to-support","depth":2}],"frontmatter":{"title":"Fin MCP connectors","description":"How Intercom identifies itself to your MCP server and its authorization server when Fin connects, including the OAuth client ID and redirect URI for each region","seo":{"title":"Fin MCP connectors"}},"lastModified":"2026-10-20T12:38:29.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/build-an-integration/learn-more/fin-mcp-connectors","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}