Skip to main content

Direct Trust

When AUTH is direct-trust, the MCP server will use the provided Tableau Direct Trust Connected App info to generate a scoped JSON Web Token (JWT) and use it to authenticate to the Tableau REST APIs.

For general multi-user HTTP deployments, prefer OAuth. Direct Trust with OAuth disabled is intended for testing/prototyping or deployments that are licensed and approved for usage-based licensing (UBL), not as the default shared-account end-user deployment path. Confirm non-OAuth HTTP usage with your Tableau licensing and security guidance.

The generated JWT will have the minimum set of scopes necessary to invoke the methods called by the tool being executed.

For example, for the query-datasource tool, since it internally calls into VizQL Data Service, the JWT will only have the tableau:viz_data_service:read scope.

When registering tools, the server checks whether the site supports Pulse and AI-powered Pulse insights (Tableau+). If the Knowledge tools are on (KNOWLEDGE_TOOLS_ENABLED=true), it also checks for Tableau Knowledge. The checks use tableau:insight_definitions_metrics:read, tableau:entitlements:read, and (Knowledge only) tableau:knowledge:read. If the Connected App doesn't grant a check's scope, the check is denied and those tools are left out, even on a site that supports the feature. Grant the scope to get them back.

Required Variables​

JWT_SUB_CLAIM​

The username for the sub claim of the JWT.

  • For OAuth-backed per-user access, set this to {OAUTH_USERNAME} so the generated JWT uses the signed-in Tableau user.
  • A hard-coded username should only be used for deployments that are licensed and approved for that usage-based licensing (UBL) pattern.

CONNECTED_APP_CLIENT_ID​

The client ID of the Tableau Connected App.

CONNECTED_APP_SECRET_ID​

The secret ID of the Tableau Connected App.

CONNECTED_APP_SECRET_VALUE​

The secret value of the Tableau Connected App.

warning

Treat your Connected App secret value securely and do not share it with anyone or in any client-side code where it could accidentally be revealed.

Optional Variables​

JWT_ADDITIONAL_PAYLOAD​

A JSON string that includes any additional user attributes to include on the JWT. It also supports dynamically including the OAuth username.

Example:

{ "username": "{OAUTH_USERNAME}", "region": "West" }

{OAUTH_USERNAME} must sit inside a quoted JSON string value, as in the example. The username is JSON-escaped before it is inserted.