Skip to content

Connect an AI Client

Purpose

Sign in from a compatible MCP client with OAuth/PKCE and create a dedicated logical user virtual key with explicitly selected tools.

Prerequisites

An active Organization/Team membership and authority to create your own user key. The Team must allow the selected tools. The client must support MCP revision 2026-07-28, remote HTTP authorization and PKCE; older initialize clients are unsupported. Open Connect a client from Team setup or the virtual-key follow-up to obtain the public inference MCP URL; those links retain the selected Team and, when supplied, logical key context.

Procedure

  1. Add https://gateway.example.test/mcp to your client. For Claude Code, run in the local directory whose configuration you intend to use:
claude mcp add --transport http mission-control https://gateway.example.test/mcp
claude mcp list
  1. Start authentication in the client. Sign in to Console and inspect the requested client and return address; approve a loopback client only when you started it.
  2. Choose the Team and explicitly select tools. The page shows one Team's tools at a time, so only the chosen Team's ticks are submitted; with a single eligible Team there is no chooser and the Team is named in a heading. Each tool is named as <tool> (<server>) with its resource identifier beneath. Nothing is selected by default; future Team additions are not automatically included. Approve to create the dedicated key/connection, or deny to issue nothing.
  3. The client completes PKCE/code exchange for the exact MCP resource. It receives an mcc_… credential and rotating refresh token; the Console does not reveal their values.
  4. Inspect/revoke the logical key under Access → Virtual keys. A new client consent creates a new connection; no restart is needed.

Expected result

Current key policy, owner membership and Team allowance govern each call. The one-hour access credential and rotating refresh family do not preserve revoked authority. This consent selects MCP tools; it does not configure the client's model provider or automatically permit model generation. A personal upstream Connector may still require My connections.

For a client that uses a saved credential instead of OAuth, Use a key instead points to Virtual keys in the current Team. User and service-account virtual keys retain their normal policy and ownership contract. Return to key policy appears when the selected ordinary key is available in that Team under your current permissions. Returning from client setup preserves context; a new OAuth consent still creates its own dedicated logical user key and does not reuse an existing key merely because its identifier appeared in the setup link.

Verification

tools/list includes only permitted selected tools. Confirm an unselected tool is unavailable. Revoking the logical key or ending its membership makes the next call/refresh fail. Canonical Requests record logical key and credential-version provenance; Connected clients terminology in older clients does not imply a separate authority model.

Failure recovery

For stale registration/redirect mismatch, remove and reconnect the client. With no eligible Team, obtain current membership and own-key creation permission. Empty tools require Team allowance and explicit consent selection. Rotated refresh reuse invalidates the family; sign in again. Protocol error -32022 requires a supported client, not a compatibility mode.

An unavailable selected key produces an explicit message and no key-policy link. Choose an available key through Virtual keys in the correct Team; changing a URL identifier cannot grant access.