Connect an agent with OAuth, or authenticate a script with an API key.

Connect an MCP client

Follow the setup guide for Claude, Cursor, or ChatGPT. For callback restrictions and the API-key fallback, see Other MCP clients.

What the consent screen shows: the app’s name, which account it will act on, and a tick-box per permission. Apps we have not recognised are marked as such — the name and logo a self-registered app supplies are chosen by whoever registered it, so we never present them as vouched for.

Manage connections

Under Settings → API keys, the Connected apps list shows every connected app, which permissions it holds, who approved it, and when it last did anything. You can disconnect any of them. Disconnecting takes effect on the app’s next call.

API keys, for scripts

A key suits anything that cannot open a browser: CI, a cron job, a backend.

Create a key

  1. Go to Settings → API keys.

  2. Type a Key name, for example "Claude connection". The name is required.

  3. Under Permissions, keep all four ticked for full access, or untick what the key should not do.

  4. Press New key.

  5. In the Key created panel, press Copy and store the key somewhere safe. You can only see the full key now.

Authorization: Bearer omk_live_xxxxxxxxxxxxxxxxxxxx

Afterwards the list shows only the key’s prefix, its last-used date and its creation date. We store keys as a SHA-256 hash, so a lost key cannot be recovered. Create a new one instead.

Keys do not expire. Revoke cuts a key off on its next call and cannot be undone, so the key list and its “last used” column are the safety net if one ever leaks.

Permissions

Both credentials carry the same four scopes: build:read, build:write, campaign:read, campaign:write. A key carries only the permissions ticked when it was created (all four by default); the key list marks such a key Full access. A call outside its scopes gets a 403 on REST. MCP returns a tool result with isError: true and prose naming the missing scope inside a JSON-RPC HTTP 200 response.

Not sure which account a credential is acting as? Call the whoami tool, or GET /app/api/me. Worth doing first when REST returns a 404 or MCP reports an object missing: a credential pointed at the wrong account fails exactly like a missing object.

What a refusal looks like

A request without a valid credential gets a 401 with a WWW-Authenticate challenge. On /mcp that challenge also points at the authorization server, which is what lets a client start the Connect flow by itself instead of asking you for a key.