MCP Service Accounts for Automated Workflows
Org admins can now create MCP service accounts right in Amplitude Settings. A service account gets its own client ID and secret and uses the OAuth 2.0 client credentials flow, so backend agents, bots, CI jobs and scripts can connect to Amplitude MCP without a person logging in through a browser.
What it is
Description: Org admins can now create MCP service accounts directly in Amplitude Settings, rather than using an API call or personal token. Each account has its own client ID and secret and uses OAuth 2.0 client credentials, so bots, backend agents, CI jobs, and scripts can connect to Amplitude MCP without an interactive login.
Why: Automated agents and shared services cannot rely on someone completing a browser login. Self-serve service accounts give those workflows a dedicated, revocable identity instead of tying access to a person's login.
Who it's for: Engineering, platform, DevOps, and AI development teams building unattended agents or CI/CD workflows; org admins and IT or security teams managing their access
What's new: • Create in Settings: Settings > Permissions > Service Accounts. • Client credentials flow: exchange the client ID + secret at the token endpoint for a short-lived access token, then send it as a Bearer token to MCP. • Scopes: new service accounts get all:read, matching the Developer API. Existing credentials keep mcp:*, and both authorize the same tools. • RBAC: service accounts follow project roles.
Where: • US: mcp.amplitude.com/mcp (token: mcp.amplitude.com/token) • EU: mcp.eu.amplitude.com/mcp (token: mcp.eu.amplitude.com/token)
Customers Impacted: Enterprise Plan Orgs with MCP access turned on. Please note - only Org Admins see the option.
Available in EUDC: Yes
Useful Resources: • x • https://amplitude.com/docs/amplitude-ai/amplitude-mcp