Calling your backend APIs · one Connections API

HubSpot hands out OAuth tokens. Loan System works with an API key. Descope Connections is the single place that stores both — and the MCP server exchanges the user's token for whichever credential the downstream backend needs.

DocsFetch connection tokens ↗Store connection tokens ↗OAuth & API key connections ↗

Section 1 · MCP server auth

Clients authenticate to Descope, then connect to loan-ops-mcp with a scoped JWT. The server validates every call; tools pull downstream credentials from the Connections Vault.

Step 5 — When a tool runs, it pulls a short-lived connection token (API key or OAuth token) from the Connections Vault and uses it to call the downstream API. Credentials never live in the agent or the server.

1 / 14

authorize

Client auth → Descope · authorized call

SSO / connection token → downstream credential

Unregistered or unauthenticated (blocked)

Descope · HubSpot connection

MCP scope → HubSpot connection scopes

scope mapping

Scope name

loans:read

HubSpot connection scopes

crm.objects.contacts.readcrm.objects.deals.read

The MCP server requests a HubSpot token by mcpScope; Descope returns a token carrying only the mapped HubSpot scopes — no more, no less.

With DescopeHubSpot token re-issued through Connections

How users originally authorize for HubSpot

Open a Claude Desktop-style flow and click through each screen manually.

hubspot · token.json