Authentication

YNAB MCP uses OAuth 2.0 to securely connect to your YNAB account. Your YNAB credentials are never shared with us - you authorize access directly through YNAB.

How it works

Authentication happens automatically when you first use YNAB MCP:

1. You send a request - Your MCP client connects to YNAB MCP
2. OAuth starts automatically - You're redirected to YNAB's authorization page
3. You authorize access - YNAB asks you to confirm access to your budget data
4. You're connected - After authorizing, you can immediately start querying your budget

No manual steps required - just add the server URL and start using it.

Getting connected

Add YNAB MCP to your Claude configuration:

{
  "mcpServers": {
    "ynab": {
      "url": "https://api.ynabmcp.com/mcp"
    }
  }
}

The first time you use a YNAB tool, you'll be prompted to authorize access through your browser.

Token security

Your tokens are protected with multiple layers of security:

• Encrypted storage - OAuth tokens are encrypted with AES-256-GCM before storage
• Per-user encryption - Each user's SQLite database is encrypted with a unique key derived from their session
• Automatic refresh - Access tokens are automatically refreshed when they expire
• MongoDB Atlas - Token storage uses MongoDB with TLS encryption in transit
• Short-lived JWTs - Session tokens are short-lived and securely signed

Revoking access

You can revoke YNAB MCP's access to your account through YNAB:

1. Go to YNAB Account Settings
2. Click "Developer Settings"
3. Find "YNAB MCP" and click "Revoke"

This will immediately invalidate your session. The next time you use YNAB MCP, you'll be prompted to re-authorize.

What data do we access?

YNAB MCP requests read-only access to your budget data:

• Budgets - List of your budgets and their settings
• Accounts - Account names, types, and balances
• Categories - Category groups, categories, and budgeted amounts
• Transactions - Transaction details including payees, memos, and amounts
• Payees - Payee names and locations

We never have access to:

• Your YNAB username or password
• Your bank credentials
• The ability to create, modify, or delete any data