Skip to main content
The MCP server accepts two credentials, and both resolve to the same ManyPI user. Either way the server itself stores nothing: it forwards your credential to the ManyPI REST API on every call, which is where authorization, rate limiting and credit accounting happen.

​
Option 1 — Sign in with your browser (OAuth 2.1)

Supported by Claude Code, Claude.ai & Desktop, Cursor and VS Code. Nothing to paste. The client registers itself with ManyPI, opens a browser, you approve, and it connects.
1

Add the server without a header

2

The client discovers the auth flow

Its first call gets a 401 carrying a WWW-Authenticate challenge that points at ManyPI’s protected-resource document, which names the authorization server and its dynamic-registration endpoint.
3

You approve

Your browser opens ManyPI’s consent screen. Approve, and the client receives an access token.
4

It just works

Every subsequent tool call carries that token.

​
Why prefer it

  • No long-lived secret sitting in a config file.
  • Revocable per client from Settings → Connected apps — revoking kills that client’s sessions and invalidates its tokens immediately, so a connected agent stops being able to act as you the moment you say so.
  • Standards-based: RFC 7591 dynamic client registration, RFC 9728 protected-resource metadata, OAuth 2.1 with PKCE.
Reviewing and revoking grants is a session-only operation. An API key or an OAuth token cannot enumerate or tear down your other connections — you have to be signed in to the dashboard.

​
Option 2 — API key

Works with every client. Create a key in Settings → API keys and send it as a header:

​
Which permissions to grant

A key that lacks a permission fails that tool with a permission error while the rest keep working — so you can hand an assistant a research-only key and keep sending under your own control.
A key with outreach:send can email your prospects from your domain. Keep it out of shared configs and out of version control.

API keys and permissions

The full permission catalogue, rate limits and rotation guidance.

​
Scope of a connection

One credential means one ManyPI workspace. The tools act on whichever workspace that credential belongs to, using the brand you are currently working in.

​
Rate limits

60 requests per minute, whether you authenticate with a key or an OAuth token. A burst of tool calls in one conversation is well inside that; a runaway loop is not, and will start receiving 429.