Installing on Liferay PaaS

On Liferay PaaS, you add the OAuth 2 client extension to your PaaS project’s repository, and deploy it with the rest of the project. The server then runs outside Liferay Cloud, on each person’s computer or on a server of yours, with the application’s credentials copied from Liferay.

These steps haven’t been run on a Liferay PaaS environment yet. They were checked with a PaaS project’s Liferay Workspace locally, as described below. Running the server as a service inside Liferay Cloud isn’t covered.

1. Step 1: Prepare the Project
2. Step 2: Add the Client Extension
3. Step 3: Copy the Credentials for the Server
4. Step 4: Run the Server
5. Without a Client Extension
6. How This Was Checked
7. Related Information

Step 1: Prepare the Project

Follow Liferay’s Configuring Liferay PaaS for Client Extensions. In particular, if your infra environment doesn’t have the client extension build pipeline, ask Liferay Cloud Support to enable it.

Step 2: Add the Client Extension

1. Download client-extension.yaml, or its read-only version, liferay-mcp-oauth-read-only.client-extension.yaml, and check its userAccountScreenName and scopes, as in Changing the Client Extension.
2. Save it as liferay/client-extensions/liferay-mcp-oauth/client-extension.yaml in your PaaS project’s repository.

3. Push the project. In the Liferay Cloud console, open Builds, and on the new build choose Deploy Build to…, then your environment.

   The build packs the folder into liferay-mcp-oauth.zip, and puts it in the Liferay service’s image, in osgi/client-extensions. When the Liferay service starts, it creates the application and its credentials.

When the deploy finishes, Control Panel → Security → OAuth 2 Administration shows the Liferay MCP server application:

Step 3: Copy the Credentials for the Server

The server isn’t in Liferay Cloud, so it can’t read Liferay’s routes. Write them yourself: create a folder named liferay-mcp-oauth with these four files, copying the values from the application’s page in OAuth 2 Administration, where Liferay shows the client extension’s Client ID and Client Secret:

Copy the scopes file too: without it, the server treats the connection as read-only.

The folder holds the application’s client secret. Keep it readable only by the server, like any password. On Liferay Self-Hosted, deploying the client extension again keeps the same credentials. On Liferay PaaS this hasn’t been checked: after a deploy, if the server reports invalid_client, copy the Client ID and Client Secret again.

Step 4: Run the Server

With LIFERAY_URL set to your environment’s Liferay address, for example https://webserver-myproject-prd.lfr.cloud:

• On each person’s computer: give each person a copy of the folder, securely, and follow With Claude Code, With the Claude Desktop App, or Other AI Assistants.
• Shared, over HTTPS, on a server of yours: follow For Services and People.

Without a Client Extension

If you can’t deploy client extensions, create the application in the Control Panel instead:

1. In Control Panel → Security → OAuth 2 Administration, click New, and fill in:

   Field	Value
   Name	Liferay MCP server
   Client Profile	Headless Server
   Allowed Authorization Types	Client Credentials only: clear JWT_BEARER
   Client Credentials User	Click Select, and choose the service user

   Leave Callback URIs empty: a Headless Server doesn’t need one.

2. Click Save. The application’s Credentials tab then shows its Client ID and Client Secret:

   

3. On its Scopes tab, select the scopes listed in the client extension file, and click Save.
4. Write the routes folder as in Step 3, with its Client ID and Client Secret.

Checked on Liferay DXP 2025.Q1.29: an application made this way, with the four files written by hand and LIFERAY_URL set, connected the server with OAuth 2 and all nine scopes, and its searches returned the site’s content.

How This Was Checked

With the Liferay Workspace of a Liferay PaaS project (DXP 2025.Q1, Workspace plugin 12.1.10), the client extension added in liferay/client-extensions/liferay-mcp-oauth/:

1. blade gw build built liferay-mcp-oauth.zip.
2. The Workspace’s dockerDeploy and createDockerfile tasks put it in the Liferay image, in osgi/client-extensions, as the PaaS build does.
3. That image, started on Liferay DXP 2025.Q1.29, created the application and its credentials at startup.
4. The server, with those credentials and LIFERAY_URL, connected with OAuth 2 and all nine scopes, and its searches returned the site’s content.

Not covered: the Liferay Cloud build pipeline and console themselves, and copying the credentials from OAuth 2 Administration on Liferay Cloud.

Related Information

• Checking the Installation
• Upgrading and Removing