Connect and authenticate

Use an authorized MCP client with Streamable HTTP. Obtain the deployment's credential-free HTTPS endpoint and the approved authentication method. If your release supports Your personal MCP endpoint in the application account card, use that exact URL with your account. Otherwise use the operator-provided shared router URL. Both paths require a verified MCP identity and the appropriate application grant.

1. Register the HTTPS URL in the client as a Streamable HTTP server. Use the configured OAuth or access-token provider and authenticate with the deployment's MCP audience. Trust the deployment's certificate chain.
2. Initialize MCP and list tools. On an endpoint that registers read_v2_session_identity, call it with {}. Compare issuer, subject and audience with the intended account and deployment.
3. Continue to application discovery. A verified subject can still lack enrollment or an application grant. If the call fails, check the exact endpoint, TLS trust, issuer, audience and account enrollment before changing a grant. Keep access tokens out of URLs, prompts and logs.

The Open EPM SDK supports an HTTPS MCP transport with a token provider. When the deployment enables its Keycloak device client, the SDK device provider can hold the session in memory. Use a verified artifact from the publisher.