# MCP User-Based Access Token callback URL format

MCP User-Based Access Token Credential Providers now generate their read-only callback URL in the form `https://<tenantId>.id.<region>.aembit.io/mcp-auth/userauth/<cp-id>/callback`.

**What this means for you:**

* **Existing Credential Providers** - Providers created before this change keep their original callback URL, which takes the form `https://<tenantId>.mcp.<region>.aembit.io/userauth/<cp-id>/callback`. Updating a provider doesn’t regenerate its callback URL. Both formats remain valid, so you don’t need to take any action or re-register anything with your MCP server vendor.
* **New Credential Providers** - Aembit assigns the callback URL when you save the Credential Provider. Save the provider first, then copy the read-only value and register it with the MCP server vendor.

Always copy the exact value shown in the Credential Provider rather than constructing the URL yourself.

For details, see [Configure MCP User-Based Access Token Credential Provider](/user-guide/access-policies/credential-providers/mcp-user-based-access-token/).