Topic starter
06/07/2026 9:43 am
TL;DR: Custom GPTs can call protected APIs through OAuth, token validation, and scope checks without standing up an MCP server, according to Descope. The real question is not whether the connection works, but whether the authorisation boundary, token lifecycle, and server-side enforcement remain defensible as agent usage scales.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Secure API Calling With Custom GPTs and Descope”.
Key questions
Q: How should teams control custom GPT access to protected APIs?
A: Treat the GPT as a delegated client, not a trusted operator.
Q: Why is OAuth alone not enough for GPT-to-API security?
A: OAuth establishes delegated access, but it does not guarantee that every request is appropriate.
Q: What are the signs that a GPT integration has weak authorization control?
A: Look for broad scopes, reused tokens across unrelated actions, unclear 401 versus 403 handling, and authorization decisions that happen outside the resource server.
Practitioner guidance
- Define endpoint-level OAuth scopes Map each GPT action to a narrowly bounded scope and avoid reusing broad scopes across unrelated operational tasks.
- Enforce JWT validation on every request Validate signature, issuer, audience and expiry in the backend before processing any GPT-originated API call.
- Treat refresh tokens as governed credentials Set session expiry, revocation and reauthentication rules so delegated access ends when the task or consent should end.
Bottom line: Custom GPTs can reach protected APIs safely only when the API, not the model, owns token validation and authorization decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:59 am
Scoped delegation, not chatbot capability, is the real control plane: This pattern succeeds or fails on whether the API server can preserve authorisation boundaries after a GPT receives tokens. The GPT is only a runtime client; the resource server must remain the source of truth for token validity, audience, issuer and scope. Practitioners should treat this as delegated identity design, not as a conversation feature.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What happens when a custom GPT keeps access after the task is complete?
A: If session expiry and revocation are not tightly managed, the GPT can continue to use delegated tokens after the user expects access to end. That turns a short-lived assistant into a standing machine client, which increases the chance of unintended API use and makes incident scoping harder.
👉 Read our full editorial: Secure API calling for custom GPTs needs OAuth and scope control