Profiles
Reuse OAuth, website logins, and static credentials across servers and environments.
Profiles hold the sign-in Manufact uses when your MCP server requires authentication. A profile can include MCP OAuth, saved website sessions and passwords, optional static headers or bearer tokens, and optional mailboxes for magic-link flows. You create profiles once at the organization level, then bind them to each server and environment.
Manufact refreshes OAuth tokens in the cloud. The dashboard does not store refresh tokens in the browser, and background jobs such as test suites and publish checks reuse the same profile binding.
Open Profiles
From the organization sidebar, go to Profiles. The table lists each profile’s status, sharing scope, connected account or sites, and which servers and environments use it.
Click a row to open the detail drawer, or Add profile to create one.
Create and connect a profile
- Click Add profile (or create from a server’s sign-in panel).
- Choose how the profile signs in:
- OAuth — complete the upstream MCP authorization flow (popup or, when available, the profile’s browser session).
- Website login — save usernames, passwords, and optional TOTP for sites your tests need outside MCP OAuth.
- Static credential — add a bearer token or custom headers when your server expects static auth instead of OAuth.
- Optionally set a label so teammates can recognize the profile in lists and pickers.
When a profile needs MCP OAuth, use Authenticate with OAuth or Connect OAuth with browser from the profile drawer or from Server sign-in on the server.
Bind profiles to servers
Each server environment uses at most one profile at a time:
| Binding | Applies to |
|---|---|
| Production | The server’s production URL |
| Preview | Every preview deployment that does not have its own branch-specific binding |
| Branch | A single non-production branch when you need different credentials than preview |
On Profiles, each row shows bound servers as badges. From a server, open Settings → Server sign-in (or Connection status on Overview) to pick an existing profile or connect a new one for the environment you have selected.
If the server’s public URL changes in a way that invalidates the saved OAuth audience, Manufact marks the binding Connection mismatch until you reconnect with a profile authorized for the new URL.
Sharing
Profiles start as Me (only the member who created them can use or edit them) or Organization (any member with profile permissions can bind and use them). Some Manufact-issued OAuth grants stay personal to the connecting member; those profiles cannot be switched to organization-wide sharing.
Members who can update profiles can change sharing in the profile drawer.
Status and maintenance
| Status | Meaning |
|---|---|
| Active | The profile is authorized for its bindings |
| Sign-in required | OAuth or website login expired — reconnect from the profile or server sign-in panel |
| Retrying | Manufact is refreshing OAuth in the background |
| Needs attention | Configuration error — open the drawer for details |
| Connection mismatch | The server URL no longer matches the credential audience |
Use Refresh in the profile drawer to force a token refresh. Disconnect removes MCP OAuth from the profile without deleting the profile row.
Permissions
Creating, viewing, updating, and deleting profiles follows the profile resource in Roles & permissions. All built-in roles include full profile access today; Enterprise custom roles can narrow it.
Related topics
- Dashboard OAuth connection — choosing a dedicated test account and how Manufact uses profiles in Chat and inspection
- Connect an existing server — bind a profile when you add an external MCP URL
- Testing — automated suites use the server’s bound profile for OAuth-protected runs