Auth, Security, and FAQ
How the LottieFiles MCP server authenticates with OAuth, how to revoke access, security guidance, and fixes for common connection issues.
The LottieFiles MCP server never uses static API keys. Every connection is authorized with OAuth against your LottieFiles account, and every action runs with exactly the permissions your account already has.
How Sign-In Works
Your MCP client discovers the server's OAuth configuration automatically (standard MCP authorization).
On first connect, a browser window opens to the LottieFiles sign-in page. You sign in (or are already signed in) and see a consent screen naming the client that's requesting access.
After you approve, the client receives short-lived access tokens and refreshes them automatically in the background. You won't be asked again until you revoke access or the session expires from inactivity.
Under the hood this is OAuth 2.1 with PKCE. There is a single permission scope, mcp:full, which grants the assistant the same access to LottieFiles that you have — no more, no less. Access tokens expire after 10 minutes and rotate via refresh tokens.
Revoking Access
From your client — remove the server from your MCP configuration, or use the client's disconnect option (for example, Settings → Connectors → Remove in Claude). Clients revoke their tokens when they disconnect.
Let sessions expire — access tokens live for 10 minutes, and idle sessions expire after 30. A revoked or expired session triggers a fresh sign-in the next time you connect.
Sign out everywhere — change your password or sign out of all sessions on lottiefiles.com to invalidate the underlying account session if you suspect misuse.
Security Guidance
Anything you can do on LottieFiles, an assistant connected through this server can do too — including modifying and deleting animations. Treat the connection like a logged-in session.
Review the consent screen. Only approve clients you recognize. The name shown is the application requesting access.
Confirm mutations. Let your assistant draft mutations and show you the GraphQL before it executes anything destructive. The
review_graphql_mutationprompt exists for exactly this.Watch for prompt injection. If your assistant also reads untrusted content — web pages, tickets, other MCP servers — that content can try to steer it into unwanted actions. Prefer clients that ask permission before each tool call, and be deliberate about "always allow".
Use a scoped account for automation. For long-running or autonomous agents, connect a LottieFiles account whose workspace membership matches what the agent should touch.
Troubleshooting
Check that your client supports remote MCP servers with OAuth (Streamable HTTP transport). If it only supports local
stdio servers, use the mcp-remote bridge shown in Connect Your Client. On headless or
remote machines (SSH, containers, WSL), complete the browser step on a machine with a browser — mcp-remote prints
a URL you can open manually.
Your session or refresh token has expired or been revoked. Reconnect the server in your client — most clients offer a reconnect or re-authenticate action; otherwise remove and re-add the server — to run the sign-in again.
This is expected. The server speaks Streamable HTTP over POST only, so opening the URL in a browser returns 405
Method Not Allowed. It's not an outage.
You've hit the rate limit of 60 requests per second. The response includes a Retry-After header — pause briefly
and retry. If an autonomous agent hits this repeatedly, batch its work or slow its loop.
The assistant is limited to what your LottieFiles account can access. Check that your account is a member of the workspace you're asking about, and that your plan includes the feature the operation touches.
Remove the server from the client, clear the client's MCP auth cache if it has one (for mcp-remote, delete
~/.mcp-auth), then add the server again.
FAQ
Is my data used to train models? No. The MCP server is a transport between your MCP client and the LottieFiles API — it doesn't train on your content. What your AI provider does with conversation data is governed by that provider's terms.
Does the server support subscriptions or streaming? No. The server rejects GraphQL subscriptions, and the transport is request/response Streamable HTTP.
Can I run it locally or self-host?
The production server is hosted at mcp.lottiefiles.com. The source is on GitHub under the MIT license if you want to run your own instance.
What data does LottieFiles see? Tool calls and the GraphQL operations they execute, associated with your account — the same visibility as using the LottieFiles apps. Standard operational metrics and logs apply.