# diagrid mcpserver access user-identity require

Require an authenticated user on calls to an MCP server

### Description

Require an authenticated end user on calls to an MCP server.

A call that carries no user identity is refused with 401 oauth.missing\_token.

Use --required-scope to narrow it further: the user's token must also carry
every scope you list, and a call missing any of them is refused with 403
oauth.missing\_scope. Scopes are matched exactly.

The scopes you pass replace the whole list, so re-running this command without
\--required-scope keeps the requirement and drops the scopes. To see what is set
now, run "diagrid mcpserver access user-identity get".

```
diagrid mcpserver access user-identity require <mcpserver> [flags]
```

### Examples

```

  # Require an authenticated user on every call to my-mcp.
  diagrid mcpserver access user-identity require my-mcp --project my-project

  # Require a user whose token carries both scopes.
  diagrid mcpserver access user-identity require my-mcp --project my-project --required-scope issues:read,issues:write

```

### Options

```
  -p, --project string           Name of existing project
      --required-scope strings   Scope the user token must carry; repeatable or comma-separated
  -w, --wait                     Wait for long-running resource update to finish
  -h, --help                     help for require
```

### Options inherited from parent commands

```
      --api-key string   Diagrid Cloud API key
```

### SEE ALSO

- [diagrid mcpserver access user-identity](./user-identity.md)	 - Manage the user identity requirement for an MCP server