# MCP server reference

Connector Central exposes one remote Streamable HTTP MCP endpoint:

```
https://connectorcentral.com/mcp
```

The endpoint requires Bearer authentication. Use either an access token issued through interactive OAuth or, on Growth and Enterprise plans, a Connector Central API key. Do not put a token, client secret, workspace identifier, or service credential in the URL.

Groups and API keys are included in the Growth and Enterprise plans. See [pricing](/pricing).

## OAuth discovery

An unauthenticated MCP request returns a Bearer challenge that points to the protected-resource metadata. A compatible client then discovers the authorization server, registers when necessary, and opens the Connector Central authorization flow.

During consent:

1. Sign in to Connector Central.
2. Choose the workspace the client should use.
3. Review the client, canonical MCP resource, and requested `profile:read` scope.
4. Approve only if the details are correct.

The issued access and refresh tokens are bound to the selected workspace and canonical MCP resource. Public clients use authorization code with PKCE `S256`.

## API key authentication

A programmatic MCP client that supports a fixed `Authorization` header can use a Connector Central API key directly:

```http
Authorization: Bearer REPLACE_WITH_API_KEY
```

An API key is a workspace-bound bearer credential accepted by the same authentication layer. It is not an OAuth client ID or client secret: it does not perform discovery, browser consent, authorization-code exchange, or refresh. An admin or owner must give the key its own per-connector access and connected-account reach.

See [API keys](/docs/api/api-keys) for creation, secure storage, least-privilege access, and revocation.

## Tool discovery

The authenticated `tools/list` response is the authority for the tools currently available to that caller in that workspace. For a user-authorized OAuth token, it is evaluated from live membership, direct or group access, account reach, and connection state. For an API key, it uses the key's own connector access and account reach. The Connectors page in your workspace lists every connector available to you.

`whoami` is the baseline identity tool. It returns the workspace identity associated with the current authorization and is useful for confirming that consent selected the intended workspace.

## Calling a tool

Use the tool name and input schema returned by the current `tools/list` response. A client should not cache a previous workspace's tool list or infer availability from documentation.

Connector Central rechecks authorization on every call. A tool can disappear or a call can be rejected after membership, permissions, or connection state changes.

## Refresh and revocation

For an interactive OAuth connection, use the refresh flow when an access token expires. To switch workspaces, disconnect and reconnect the client, then select the other workspace during consent.

Disconnecting Connector Central in the AI client removes the local connection. Revoke the authorization in Connector Central as well when you want its access and refresh tokens to stop working.

An API key stays valid until you revoke it. Revoke a key in Connector Central to stop it immediately. Reactivation issues a new one-time value; the old value stays unusable.

## Common errors

| Condition | Result |
|---|---|
| Missing authorization | Bearer challenge with protected-resource metadata |
| Invalid, expired, or revoked token | Authentication error; refresh or reconnect OAuth, or replace a revoked API key |
| Token for a different resource | Request rejected |
| Workspace membership or access removed | Tool omitted or call rejected |
| Unknown tool or invalid arguments | MCP invalid-request response |
| Request limit exceeded | Rate-limited response with retry guidance |

## Related guides

- [Connect ChatGPT](/docs/connect-ai-clients/chatgpt)
- [Connect Claude](/docs/connect-ai-clients/claude)
- [Connect Microsoft Copilot](/docs/connect-ai-clients/microsoft-copilot)
- [Manage connectors, accounts, and access](/docs/connectors-and-access/connectors-accounts-and-access-grants)
- [Use API keys](/docs/api/api-keys)
- [Review the activity log](/docs/connectors-and-access/activity-log)