An AI assistant reaches your organisation’s MCP servers in one of two ways: with an API key, or as an app you connected with a sign-in. This page shows how to set up each one safely and how to end access. The connection steps are in Connect an AI assistant.
MCP keys
There is no separate kind of MCP key. An MCP key is an ordinary API key that holds the permission Connect MCP clients (mcp_server.connect), made on API Keys like any other. See Authentication.
What to tick
| Permission | Needed for |
|---|---|
| Connect MCP clients (group MCP) | Reaching any MCP server at all |
View devices (iot_device.devices.read) | list_devices, get_device |
Telemetry read (telemetry.read) | get_latest_readings, get_reading_series |
Use the modules’ Read only presets; nothing else is needed. A key with Connect MCP clients but without a tool’s permission sees no such tool. A key without Connect MCP clients is refused by every MCP server, whatever else it holds.
Each tool runs only while both the key and its holder hold the tool’s permission. If the holder loses a permission, the assistant loses the tool on its next call.
Good practice
- One key per assistant and person. Name it so you can tell who uses it: “Desktop assistant – Alex”.
- Short expiry. 30 to 90 days, then rotate.
- IP allowlist when the assistant runs on a fixed server.
- No other permissions. An MCP key with extra permissions also works on the REST API with them.
- Keep the key out of shared files. Assistant configuration files are often synced or committed; store the key in the assistant’s secret store or an environment variable where it allows.
Watching and ending a key
- The key’s page shows Last used, Last used IP and Total verifications.
- Every tool call is in the audit log as
mcp_server.tool.called(ormcp_server.tool.refused), with the key as the actor, the tool, the outcome and the duration. - Deactivate, Revoke or Rotate key on the key’s page ends or replaces access at once. See Authentication.
- The AI firewall records incidents about keys that misbehave. Its actions (throttling or switching off a key) are in development.
Connected apps
An app you connected with a sign-in is listed on Connected apps (in the Developer part of the menu): “AI apps you connected to this workspace with a sign-in. Disconnecting one stops it at once.”
| Column | Shows |
|---|---|
| App | The app’s name and host |
| Access | Read or Read and change |
| Status | Connected, Disconnected or Paused by the AI firewall |
| Connected | When you approved it |
| Last used | Its last call |
Use Search app or host… to find one. Administrators (who hold Manage MCP settings) can switch between Mine and Everyone (admins) to see every member’s apps.
Disconnect an app
- Open Connected apps.
- Select Disconnect on the app’s row.
- Confirm Disconnect this app?: “
will lose access to this workspace at once. To use it again, connect it again.”
The next call of the app is refused with 401. Members can disconnect their own apps; administrators can disconnect anyone’s. Disconnecting needs a signed-in person: an API key cannot do it.
A connection also ends:
- after 90 days (connect it again),
- when its refresh token is used twice, which can mean it was copied (the connection is revoked and the event is audited as high severity),
- when the person who connected it is no longer an active member.
Paused by the AI firewall
In development: The AI firewall’s actions, including pausing a connected app, are in development. Today the firewall records incidents only; see AI firewall.
When this action is released, a paused app is refused on every call for up to 7 days and its status shows Paused by the AI firewall. If you see that status and did not expect it, disconnect the app and check the audit log before you connect it again.
Over HTTP
| Method | Path | Who | Does |
|---|---|---|---|
| GET | /api/mcp/grants | Any signed-in member with Connect MCP clients | Your connected apps: { data, total } |
| GET | /api/mcp/grants/all | Manage MCP settings | Everyone’s |
| DELETE | /api/mcp/grants/{grantId} | The app’s owner, or an administrator | Disconnect: { "revoked": true } |
Lists take page (from 0), pageSize (default 20, at most 100), search (app name or host), sort and status (active, suspended, revoked). Paths are under https://<your host>/tenant/<tenantId>.
Which way to choose
| Situation | Use |
|---|---|
| An assistant on your own computer | An API key, or the sign-in if the assistant offers it |
| A hosted assistant that adds connectors by address | The sign-in |
| A scheduled agent or script without a person | An API key, marked as a service key if it must outlive its creator |
| A shared team assistant | One API key per assistant with read-only permissions; never a person’s sign-in |