OAuth 2.0 Support

QuestionPro supports OAuth 2.0, the industry standard for delegated authorization. Third-party and AI applications access QuestionPro on a user's behalf through a revocable token. They never receive the user's password.

OAuth 2.0 secures every QuestionPro MCP connection, including ChatGPT, Claude, Microsoft Copilot Studio, and any MCP-compatible client.

QuestionPro uses the OAuth 2.0 authorization code flow:

1. The application redirects the user to QuestionPro.

2. The user signs in through their normal login, including SSO and two-factor authentication.

3. The user reviews the requested access and approves it.

4. QuestionPro issues an access token. The application uses it within the user's existing permissions.

In the application, add a connection using the QuestionPro MCP server URL: https://mcp.questionpro.com.

Under Authentication, select OAuth 2.0.

Click Connect, sign in to QuestionPro, and click Approve.

For application-specific steps, see ChatGPT, Claude, and Microsoft Copilot.

Note: Use a product-specific endpoint, such as https://mcp.questionpro.com/bi, to restrict an application to a single product.

• No password sharing: Credentials are entered only on QuestionPro.
• Least privilege: Applications inherit the user's role and permissions, nothing more.
• Identity provider enforcement: Every authorization passes through SAML 2.0 SSO and two-factor authentication where enabled.
• Encryption in transit: All authorization and data traffic uses TLS.
• Revocable access: Users can disconnect an application at any time.

Does QuestionPro support OAuth 2.0?

Yes. QuestionPro supports the OAuth 2.0 authorization code flow for third-party and AI applications.

Does OAuth 2.0 work with our SSO?

Yes. OAuth authorization uses the same SAML 2.0 sign-in your users already follow.

How do server-to-server integrations authenticate?

The QuestionPro REST API uses an API key. See Developer Settings.