# Authentication

The OneTick MCP server has two independent authentication layers:

1. `MCP server authentication` — controls who can connect *to* the MCP server; uses OIDC/OAuth2 SSO. Disabled by default — enable for any deployment exposed beyond localhost.
2. `OneTick WebAPI authentication` — controls how the MCP server authenticates *to* the OneTick WebAPI for symbology lookups. Only relevant if the symbology tool is enabled.

The two layers are configured and operated independently.