Skip to main content
Two credentials are involved, and they are not interchangeable. Connecting ChatGPT does not connect Google Ads. Finish both. See Connect ad accounts.

​
Hosted OAuth

Clients that speak MCP OAuth use the server URL alone:
The protected-resource metadata for that URL names the same host as the authorization server. The client opens a browser login, stores its own session, and refreshes it. Prefer this when the client offers it.

​
API tokens

Create a token at API Keys when the client wants a header:
The token is a secret. Put it in the client config, not in a prompt, a screenshot, or a repository. Deleting the token in the dashboard revokes it. Production checks tokens against the tenant store. A static MCP_ACCEPT_TOKENS value is not accepted in production. Send Idempotency-Key on write calls so a retry does not create a second action. Read calls do not need it.

​
What a successful call looks like

get_connections_status returns the platforms connected for that tenant. get_usage_status returns the quota row. A 401 means the OAuth session or bearer token was missing or rejected. A connected platform can still fail later if its own OAuth grant expired. Reconnect that platform on the Connections page.