Connect an agent with OAuth, or authenticate a script with an API key.
Connect an MCP client
Follow the setup guide for Claude, Cursor, or ChatGPT. For callback restrictions and the API-key fallback, see Other MCP clients.
What the consent screen shows: the app’s name, which account it will act on, and a tick-box per permission. Apps we have not recognised are marked as such — the name and logo a self-registered app supplies are chosen by whoever registered it, so we never present them as vouched for.
Manage connections
Under Settings → API & Connected apps you can see every connected app, which permissions it holds, who approved it, and when it last did anything — and disconnect any of them. Disconnecting takes effect on the app’s next call.
API keys, for scripts
A key suits anything that cannot open a browser: CI, a cron job, a backend. Create one under Settings → API & Connected apps. The full key is shown once, then only its prefix.
Authorization: Bearer omk_live_xxxxxxxxxxxxxxxxxxxx
Keys do not expire. Revoking one cuts it off on its next call, so the key list and its “last used” column are the safety net if one ever leaks.
Permissions
Both credentials carry the same four scopes: build:read, build:write, campaign:read, campaign:write. A call outside its scopes gets a 403 on REST. MCP returns a tool result with isError: true and prose naming the missing scope inside a JSON-RPC HTTP 200 response.
Not sure which account a credential is acting as? Call the whoami tool, or GET /app/api/me. Worth doing first when REST returns a 404 or MCP reports an object missing: a credential pointed at the wrong account fails exactly like a missing object.
What a refusal looks like
A request without a valid credential gets a 401 with a WWW-Authenticate challenge. On /mcp that challenge also points at the authorization server, which is what lets a client start the Connect flow by itself instead of asking you for a key.