MCP authentication

How authentication works when connecting your editor to the Buron MCP server, and how to handle CI and headless environments.

When your editor connects to the Buron MCP server for the first time, it opens your browser to sign in. You log in with your Buron account, pick your workspace if you have more than one, and approve the connection. Your editor handles the rest: no tokens to copy, no config to edit.

The session lasts until it expires. When it does, your editor opens the browser again. Most editors handle the refresh silently.

How the server picks your team

The server URL is the same for everyone:

https://app.buron.ai/api/mcp

Every request is scoped to a team, resolved from your sign-in: the workspace you approved during OAuth, and its team. If that workspace has exactly one team (the common case), the clean URL is all you need.

If your workspace has more than one team, pin one explicitly:

https://app.buron.ai/api/mcp?teamId=<team-id>

You'll find the exact URL under Settings, then MCP in Buron. buron setup always pins the linked team's id, so configs it writes work in any workspace shape.

Multiple teams at once

To talk to two teams from the same editor, add a second server entry with a different teamId. In Claude Code that's .mcp.json at the repo root:

{
  "mcpServers": {
    "buron": {
      "type": "http",
      "url": "https://app.buron.ai/api/mcp?teamId=<team-a>"
    },
    "buron-other-team": {
      "type": "http",
      "url": "https://app.buron.ai/api/mcp?teamId=<team-b>"
    }
  }
}

CI and headless environments

Where there's no browser, use the Buron CLI with a token instead of the MCP server. Mint one from your logged-in CLI:

buron token create

The token is shown exactly once. Store it as a secret and set it as BURON_TOKEN in the job:

export BURON_TOKEN="brnci_..."
buron file read /wiki/company.md

See Run Buron from CI for the full setup.

Treat CI tokens like passwords. Add them as secrets in your CI provider, never paste them into code or logs.

Revoking access

To disconnect an editor, remove the Buron server from its MCP config (or disconnect it from the client's MCP panel). The OAuth session expires on its own.

To rotate a CI token:

buron token list
buron token revoke <id>
buron token create

Then update the secret in your CI provider.

Troubleshooting

"Missing authorization token" error. Your editor didn't complete the sign-in flow. In Claude Code, run /mcp, select buron, and choose Authenticate. In other editors, restart so the browser sign-in triggers again.

"This workspace has multiple teams" error. The clean URL can't pick a team for you. Add ?teamId=<team-id> to the server URL, or copy the full URL from Settings, then MCP.

Sign-in loop. If your browser keeps opening, your session may have expired or been revoked. Clear your editor's MCP credential cache and sign in fresh. In Claude Code, run /mcp to see server status and reconnect.