# Authentication & access

Canonical URL: https://support.optimonk.com/en/articles/authentication-and-access

Connect an agent with OAuth, or authenticate a script with an API key.

## Connect an MCP client

Follow the setup guide for [Claude](/en/articles/connect-claude), [Cursor](/en/articles/connect-cursor), or [ChatGPT](/en/articles/connect-chatgpt). For callback restrictions and the API-key fallback, see [Other MCP clients](/en/articles/other-mcp-clients).

What the consent screen shows: the app’s name, which account it will act on, and a tick-box per permission. Apps we have not recognised are marked as such — the name and logo a self-registered app supplies are chosen by whoever registered it, so we never present them as vouched for.

## Manage connections

Under `Settings → API & Connected apps` you can see every connected app, which permissions it holds, who approved it, and when it last did anything — and disconnect any of them. Disconnecting takes effect on the app’s next call.

## API keys, for scripts

A key suits anything that cannot open a browser: CI, a cron job, a backend. Create one under `Settings → API & Connected apps`. The full key is shown once, then only its prefix.

```
Authorization: Bearer omk_live_xxxxxxxxxxxxxxxxxxxx
```

Keys do not expire. Revoking one cuts it off on its next call, so the key list and its “last used” column are the safety net if one ever leaks.

## Permissions

Both credentials carry the same four scopes: `build:read`, `build:write`, `campaign:read`, `campaign:write`. A call outside its scopes gets a `403` on REST. MCP returns a tool result with `isError: true` and prose naming the missing scope inside a JSON-RPC HTTP 200 response.

Not sure which account a credential is acting as? Call the `whoami` tool, or `GET /app/api/me`. Worth doing first when REST returns a 404 or MCP reports an object missing: a credential pointed at the wrong account fails exactly like a missing object.

## What a refusal looks like

A request without a valid credential gets a `401` with a `WWW-Authenticate` challenge. On `/mcp` that challenge also points at the authorization server, which is what lets a client start the Connect flow by itself instead of asking you for a key.