Connector Central Connector Central

MCP server reference

Connector Central exposes one remote Streamable HTTP MCP endpoint:

https://connectorcentral.com/mcp

The endpoint requires Bearer authentication. Use either an access token issued through interactive OAuth or, on Growth and Enterprise plans, a Connector Central API key. Do not put a token, client secret, workspace identifier, or service credential in the URL.

Groups and API keys are included in the Growth and Enterprise plans. See pricing.

OAuth discovery

An unauthenticated MCP request returns a Bearer challenge that points to the protected-resource metadata. A compatible client then discovers the authorization server, registers when necessary, and opens the Connector Central authorization flow.

During consent:

  1. Sign in to Connector Central.
  2. Choose the workspace the client should use.
  3. Review the client, canonical MCP resource, and requested profile:read scope.
  4. Approve only if the details are correct.

The issued access and refresh tokens are bound to the selected workspace and canonical MCP resource. Public clients use authorization code with PKCE S256.

API key authentication

A programmatic MCP client that supports a fixed Authorization header can use a Connector Central API key directly:

Authorization: Bearer REPLACE_WITH_API_KEY

An API key is a workspace-bound bearer credential accepted by the same authentication layer. It is not an OAuth client ID or client secret: it does not perform discovery, browser consent, authorization-code exchange, or refresh. An admin or owner must give the key its own per-connector access and connected-account reach.

See API keys for creation, secure storage, least-privilege access, and revocation.

Tool discovery

The authenticated tools/list response is the authority for the tools currently available to that caller in that workspace. For a user-authorized OAuth token, it is evaluated from live membership, direct or group access, account reach, and connection state. For an API key, it uses the key's own connector access and account reach. The Connectors page in your workspace lists every connector available to you.

whoami is the baseline identity tool. It returns the workspace identity associated with the current authorization and is useful for confirming that consent selected the intended workspace.

Calling a tool

Use the tool name and input schema returned by the current tools/list response. A client should not cache a previous workspace's tool list or infer availability from documentation.

Connector Central rechecks authorization on every call. A tool can disappear or a call can be rejected after membership, permissions, or connection state changes.

Refresh and revocation

For an interactive OAuth connection, use the refresh flow when an access token expires. To switch workspaces, disconnect and reconnect the client, then select the other workspace during consent.

Disconnecting Connector Central in the AI client removes the local connection. Revoke the authorization in Connector Central as well when you want its access and refresh tokens to stop working.

An API key stays valid until you revoke it. Revoke a key in Connector Central to stop it immediately. Reactivation issues a new one-time value; the old value stays unusable.

Common errors

Condition Result
Missing authorization Bearer challenge with protected-resource metadata
Invalid, expired, or revoked token Authentication error; refresh or reconnect OAuth, or replace a revoked API key
Token for a different resource Request rejected
Workspace membership or access removed Tool omitted or call rejected
Unknown tool or invalid arguments MCP invalid-request response
Request limit exceeded Rate-limited response with retry guidance

Related guides