Connect a client

Two doors lead to the same server. An API key is the fastest path and pins every call to one organization. OAuth 2.1 signs a person in through the browser and can reach every organization they belong to.

Option A — Organization API key

Create a key in the dashboard under Settings → API (see API keys), then pass it as a bearer token. A key is bound to exactly one organization, so tools act on that organization with no further selection.

claude mcp add inklate https://api.inklate.com/mcp -t http \
  -H "Authorization: Bearer inklate_XXXXXXXX"
claude mcp list          # inklate should show connected

Option B — OAuth 2.1

Inklate is a full OAuth 2.1 provider: dynamic client registration, PKCE, and a consent screen. Add the server with no auth header — the first unauthenticated call returns 401 with a WWW-Authenticate header that starts discovery and the browser handshake.

claude mcp add inklate https://api.inklate.com/mcp -t http
# then in a session:  /mcp  → Authenticate → finish in the browser

An OAuth connection is not pinned to one organization. Tools act on your active organization by default; pass an organization slug (from organizations_list) to target a specific one. Every tool accepts that optional argument — it only matters on this door.

Cursor and Claude Desktop

{
  "mcpServers": {
    "inklate": {
      "url": "https://api.inklate.com/mcp",
      "headers": { "Authorization": "Bearer inklate_XXXXXXXX" }
    }
  }
}

A local stdio server

inklate mcp runs the same tool surface over stdio, for clients that prefer a local process to a remote URL. It uses the credential the CLI already stored, so there is no key to paste into a config file:

npm i -g inklate
inklate auth login          # device flow: approve a short code in the browser
inklate mcp                 # stdio MCP server on this machine

See inklate mcp for the flags, and inklate auth login for how the credential is stored.

Verify the connection

Ask the agent to list your organizations. It should call organizations_list and come back with slugs and your role in each — that round trip proves transport, credential, and tenancy are all working:

> which Inklate organizations can you act in?

If the call fails, the error text names the cause: UNAUTHORIZED means the credential was rejected, FORBIDDEN means it is valid but not permitted to do that.