Skip to main content
There are two ways in:
  • Sign in (OAuth), for AI assistants such as Claude, ChatGPT, Grok and Cursor that connect to the MCP server. Nothing to copy or store.
  • API keys, for the REST API, your own code, and assistants that can’t sign in.
Both end up as the same kind of credential, with the same permissions, channel limits and rate limits.

​
Sign in with OAuth (MCP)

The MCP server is an OAuth 2.1 authorization server. Clients find it on their own from https://mcp.autoadify.com/.well-known/oauth-protected-resource, register themselves (dynamic client registration), and sign in with PKCE. You only paste the server URL.
  1. The assistant opens an Autoadify page asking you to approve the connection.
  2. You choose which permissions to grant: Read, Generate and Publish.
  3. The assistant receives a one-hour access token and a refresh token, which it renews by itself.
Approving needs a sign-in to Autoadify within the last 15 minutes, the same as creating a key, so you may be asked to confirm it’s you.
  • Each app has one live connection per person. Connecting the same app again replaces the old connection.
  • Connections don’t count towards your plan’s key limit.
  • See and disconnect connected assistants on the Claude & ChatGPT page in Autoadify. Disconnecting stops the assistant within seconds.
If you build your own client, the endpoints are listed at https://mcp.autoadify.com/.well-known/oauth-authorization-server. Redirect URIs must be https, or http on localhost/127.0.0.1 (any port).

​
API keys

Every request with a key carries it in the Authorization header:

​
Creating keys

Create and revoke keys in Autoadify → Settings → API & MCP. You’ll be asked to confirm it’s you before a key is created.
  • The full key is shown once, when it’s created. Autoadify stores only a hash of it, so it can’t show it again. If you lose it, revoke it and create a new one.
  • A key acts as you: anything it does is recorded as done by you, and it can never do more than your role in the organization allows.
  • The API and MCP server are available on the Pro, Team and Enterprise plans. If your organization moves to Free or Solo, its keys and connections stop working until it upgrades.

​
Permissions

Each key has one or more permissions (scopes). Give a key only what it needs. Permissions apply the same way to keys and to signed-in assistants. A request without the right scope gets 403 with the code forbidden_scope. On the MCP server, tools the credential can’t use aren’t listed at all. Viewers can only grant read. If your role changes later, your keys and connections shrink with it within about 30 seconds.

​
Limiting a key to some channels

When you create a key you can pick Only selected channels. That key then:
  • only sees those channels in List channels,
  • can only post to them,
  • only sees posts that go exclusively to them.
This is a good idea for anything you hand to an automation or an agent.

​
Expiry and revocation

Keys can expire after 30 days, 90 days or a year, or never. Revoking a key in Settings → API & MCP stops it working everywhere within seconds. Signed-in assistants stay connected until you disconnect them.
Treat keys like passwords. Never put one in client-side code, a public repository or a shared document.