# MCP server environment variables (for Aembit MCP Authorization Server)

> Reference for environment variables to configure MCP servers to use the Aembit MCP Authorization Server

These environment variables configure your MCP server (resource server), so it can use the Aembit MCP Authorization Server. Use these environment variables to configure your MCP server and **not** the Aembit-hosted MCP Authorization Server.

## MCP server environment variables

The following environment variables configure your MCP server to work with the Aembit MCP Authorization Server.

### `MCP_SERVER_HOST`

Default - `0.0.0.0`

The network interface address your MCP server binds to.

*Example*:\
`0.0.0.0`

***

### `MCP_SERVER_PORT`

Default - `8000`

The port your MCP server listens on.

*Example*:\
`8000`

***

### `MCP_SERVER_URL` Required

Default - not set

The public URL of your MCP server. OAuth callbacks and token audience validation use this URL. It must match the URL that MCP clients use to connect to your server and the Server Workload configuration in Aembit.

See [URL configuration alignment](/ai-guide/mcp/authorization-server/concepts-mcp-auth-server/#url-configuration-alignment) for details on ensuring your URLs match correctly.

*Example*:\
`http://localhost:8000`

***

### `AEMBIT_MCP_AUTH_SERVER` Required

Default - not set

The URL of the Aembit MCP Authorization Server for your tenant. This URL uses the `.mcp.` subdomain.

You can find this URL in the **Aembit MCP Authorization Server URL** field when you configure a Server Workload with the MCP application protocol.

*Example*:\
`https://abc123.mcp.useast2.aembit.io`

***

### `AEMBIT_ISSUER` Required

Default - not set

The token issuer URL used during JWT verification. This URL uses the `.id.` subdomain, **not** the `.mcp.` subdomain.

> **Caution**
>
> The issuer URL must use the `.id.` subdomain (for example, `abc123.id.useast2.aembit.io`). Using the `.mcp.` subdomain causes token verification to fail.

See [Tenant URL patterns](/ai-guide/mcp/authorization-server/reference-mcp-auth-server/#tenant-url-patterns) for details on Aembit subdomain usage.

*Example*:\
`https://abc123.id.useast2.aembit.io`

***

### `AEMBIT_JWKS_URI` Required

Default - not set

The JSON Web Key Set (JWKS) endpoint for token signature verification. Your MCP server uses this endpoint to retrieve the public keys needed to validate access tokens issued by the Aembit MCP Authorization Server.

*Example*:\
`https://abc123.mcp.useast2.aembit.io/.well-known/openid-configuration/jwks`

## Related resources

For an example of how to use these environment variables in a Python MCP server, see [Test with a demo MCP server](/ai-guide/mcp/authorization-server/setup-mcp-auth-server/#test-with-a-demo-mcp-server) in the setup guide.

* [MCP Authorization Server reference](/ai-guide/mcp/authorization-server/reference-mcp-auth-server/)
* [Set up the MCP Authorization Server](/ai-guide/mcp/authorization-server/setup-mcp-auth-server/)
* [Tenant URL patterns](/ai-guide/mcp/authorization-server/reference-mcp-auth-server/#tenant-url-patterns)