# Deploy a remote MCP server with OAuth

A personal task inbox lets each visitor connect an MCP client, authorize with their email, and manage only their own saved tasks. Tokay runs the Express and SQLite app as one Web Service and supplies the OAuth layer around it.

Use it when real people should approve an AI client without sharing accounts or letting one visitor choose another person's data. Your app receives a verified identity and keeps its tool logic focused on tasks.

## Facts

- Runtime: Node.js
- Framework: Express and MCP SDK
- Service types: Web Service
- Resources: SQLite
- Required secrets: None

## What it does

The landing page gives each visitor the Claude Code commands for connecting and signing in.

After consent, the MCP client can list, create, update, complete, reopen, and delete that visitor's tasks. Due dates and completion state stay with the same person through later sessions.

A second visitor uses the same endpoint but starts with an empty inbox. The app never accepts an email address as a tool argument, so the client cannot select someone else's account.

## Deploy it

Bring this folder to Tokay any way you like. Paste or upload it in the dashboard, push it with git, or hand it to your AI agent along with [our agent instructions](https://app.tokay.io/llms.txt). Tokay figures out the rest.

Working in Claude, ChatGPT, VS Code, or another MCP client? Connect the [Tokay MCP server](https://tokay.io/docs/platform-mcp) and ask your agent to deploy this example. It signs in through your browser, so there is no token to paste.

New to Tokay? The [getting started guide](https://tokay.io/getting-started) walks you through your first deploy.

## Turn on visitor OAuth

OAuth is automatic for restricted Tokay apps. There are no client IDs, callback URLs, OAuth secrets, or environment variables to configure in this project.

1. Open the Project and choose **App audience**.
2. Under **Audience**, choose **Specific people**.
3. Under **Specific people**, add each outside visitor who should connect. Project admins already have access.
4. Choose **Save audience**, then confirm with **Save**.

Restricted Services automatically publish the standard MCP protected-resource metadata and OAuth authorization-server metadata. Each visitor signs in and approves their own connection. The builder does not mint a token on their behalf.

## Connect from Claude Code

Copy the live URL from the top of the Service page. Replace the placeholder below with that URL, then connect Claude Code.

```sh
export SERVICE_URL="https://your-service.tokay.app"
claude mcp add --transport http task-inbox "$SERVICE_URL/mcp"
claude mcp login task-inbox
```

Claude Code opens a browser. Enter an approved email, follow the magic link, and approve the connection. Then ask Claude to add a task.

If you add a second visitor, have them connect with their own email. Their list starts empty even though both people use the same MCP URL and SQLite database.

## Try it

1. Ask your client to add `Renew passport` with a due date next Friday.
2. Mark that task complete, then deploy the app again.
3. List completed tasks. Your passport reminder remains, while another visitor still sees only their own inbox.

## How OAuth identity reaches the app

You do not need to trust identity sent by the MCP tool call. Tokay's access layer publishes OAuth discovery, completes consent, validates the bearer token, removes it, and injects trusted identity headers only after authorization succeeds.

The app requires a human actor on every `/mcp` request. Every task query includes `X-Tokay-Actor-Id` as its owner key. Machine tokens and anonymous calls are rejected because this inbox belongs to individual people.

## Secrets

You have no OAuth secret to configure. Tokay owns authorization and passes verified visitor identity to the app.

## Grow from here

Use the [private sales analytics MCP server](/examples/node-express-sqlite-mcp-orders) when a headless agent should connect with a machine token instead of a person's OAuth grant.

## Source files

- [package.json](https://tokay.io/examples/src/node-express-sqlite-oauth-mcp-task-list/package.json)
- [src/server.ts](https://tokay.io/examples/src/node-express-sqlite-oauth-mcp-task-list/src/server.ts)
- [tsconfig.json](https://tokay.io/examples/src/node-express-sqlite-oauth-mcp-task-list/tsconfig.json)

## Download and source

- [Download the complete project](https://tokay.io/examples/downloads/node-express-sqlite-oauth-mcp-task-list.zip)
- Last updated: 2026-07-31
- Example revision: `52c7b7f`
- [View this revision on GitHub](https://github.com/tokayio/tokay-examples/tree/52c7b7ffd52e157375b08f1f11ff4fbe6c498642/node-express-sqlite-oauth-mcp-task-list)
- [Deploy an MCP server](https://tokay.io/use-cases/deploy-mcp-server)