When OAuth2 authentication is enabled, Qaynaq supports two primary roles to control access to the dashboard, API, and MCP server. If no role configuration is provided, all users passing the initial allowlist gate are treated as Admins.
- Admin: Full access to the management dashboard, the API (
/api/*), and the MCP server (/mcp). - MCP: Can complete the OAuth handshake from MCP clients (e.g., Claude Desktop, Cursor) and access the MCP server, but cannot access the dashboard or API. They are redirected to a page containing the MCP server URL and setup snippets.
- No Role: Users who authenticate but do not match Admin or MCP criteria are sent to a 'no access' page.
Note: Basic auth always treats the configured user as Admin. If AUTH_TYPE=none, all users are treated as Admin.