Compare
Simplest passwordless path for teams who already like TuraLogin. Not trying to replace a full enterprise IdP on day one.
Static API keys
Fit: Works for one shared secret in client config
Gap: Poor for multi-user, rotation, and SSO. Keys live forever in mcp.json.
DIY Cognito / Auth0
Fit: Full OAuth control if you already run an IdP
Gap: Heavy for small MCP servers. You wire AS metadata, PKCE, consent, JWKS yourself.
WorkOS / Descope MCP
Fit: Enterprise SSO and org features
Gap: More product than you need for passwordless email on a private MCP.
TuraMCP
Fit: Passwordless email + MCP-compatible tokens. Same clarity as TuraLogin.
Gap: Not a full enterprise IdP on day one. Auth only, not tool hosting.
Security model (short)
- No passwords stored.
- PATs hashed at rest; shown once at create; revocable.
- Phase 2: short-lived access tokens, rotatable refresh, PKCE required.
- Tokens bound to resource audience.
- Auth events logged without leaking tokens or magic-link secrets.