# The Auth API MCP connector The Auth API connector brings access keys, projects, user roles, webhooks and accounts into Elaichi, so Claude, ChatGPT, Cursor or any MCP client can list, create and update them inside each person's own access. Source: https://elaichi.ai/connectors/theauthapi/ ## Facts | | | | --- | --- | | Application | The Auth API | | Category | Security | | AI tools | 57 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | No. 57 tools is past the 30-tool threshold, so clients use `search_tools` and `execute_tool` | ## What you can ask once The Auth API is connected - List access keys created in the last 7 days. - Which projects have keys with no recent activity? - Show user roles across the Payments project. ## Connect The Auth API in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick The Auth API. 2. Optionally set Share with, then press Connect. 3. Paste a The Auth API API key. One person generates a token in The Auth API and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which The Auth API tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect The Auth API to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect The Auth API to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect The Auth API to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect The Auth API to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a The Auth API tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with The Auth API through Elaichi ### Audit every active access key Security. Ask for every access key across your The Auth API projects, spot the ones nobody recognizes, and deactivate them from the same conversation. ### Spin up a project with its keys Engineering. Create a new The Auth API project for a service, add the access keys it needs, and hand the details to the team without opening the console. ### Fix a locked out teammate fast IT. Find the deactivated access key behind a failing login and reactivate it, or update the user role that is missing, while the person is still on the call. ### Keep webhooks pointed at the right place Platform. List every The Auth API webhook, update the ones still calling an old URL, and send a ping to confirm each one answers before you close the ticket. ### Check a customer account before replying Support. Pull up a customer's The Auth API account and the role attached to it, so the answer you send is based on what is actually configured. ### Onboard a new customer account Product. Create the account, set its user role, and subscribe a webhook to the events the customer asked for, all in one pass. ## Frequently asked questions ### How do I connect The Auth API to Claude? Connect The Auth API in Elaichi first: pick it from the catalog and paste in an API key from your The Auth API console. There is no OAuth application to register and no client ID or secret to generate. Then open Claude, go to Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp as the endpoint. Claude asks you to sign in to Elaichi and The Auth API is ready to use. ### Does The Auth API work with ChatGPT and Cursor as well as Claude? Yes. The Auth API is connected once in Elaichi and exposed at https://api.elaichi.ai/mcp, the same endpoint for every client. Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent all reach it through that one address, so there is nothing to set up a second time. ### What can an AI agent actually do with my The Auth API data? It can list, create, update and delete access keys, reactivate a key that was switched off, and manage projects, user roles and accounts in The Auth API. It can also list webhooks and their topics, create or update a webhook, and ping one to confirm it responds. Because The Auth API has a large set of actions, short concrete asks like "list access keys for the billing project" work better than long paragraphs. ### Does connecting The Auth API give the AI access to every project and key? No. Every call to The Auth API runs inside the access of the person who signed in to Elaichi, so the agent sees only the projects, keys, roles and accounts that person could already reach. Elaichi can narrow that further with restrictions on specific actions, and it never widens what a person can do in The Auth API. ### Can my team share one The Auth API connection? Yes. One person connects The Auth API with an API key and shares the connection with a team in Elaichi, and nobody else ever sees or handles that key. Each teammate still signs in to Elaichi as themselves, so the audit log names the actual person behind every change to a key, project or webhook. ### Can I stop an agent from deleting or changing things in The Auth API? Yes. Restrictions in Elaichi apply per action, so you can block deleting access keys, projects, user roles or webhooks in The Auth API while still allowing listing and creating. A blocked action is never shown to Claude, ChatGPT, Cursor or any other client, so no prompt, however worded, can reach it. ### What happens to a The Auth API connection when someone leaves? Offboarding a person in Elaichi ends their access to The Auth API at once, across every client they used. A shared The Auth API connection keeps working for everyone else on the team. If you want to remove The Auth API entirely, disconnecting it once in Elaichi takes it out of Claude, ChatGPT, Cursor and every other client at the same time. ## All 57 The Auth API tools Every tool below is callable through https://api.elaichi.ai/mcp once The Auth API is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all The Auth API misc** (List). List resources from the theauthapi root endpoint. Returns a 200 response; the upstream source does not enumerate any response fields or parameters for this endpoint. - **List all The Auth API access keys** (List). List theauthapi access keys for an account. Returns: key, accountId, projectId, isActive. Required: accountId. - **Create a The Auth API access key** (Create). Create a new access key in theauthapi. Returns: key, accountId, projectId, isActive. Required: accountId. - **Update a The Auth API access key by ID** (Update). Update an existing theauthapi access key by id. Returns: key, accountId, projectId, isActive. Required: id. - **Delete a The Auth API access key by ID** (Delete). Delete a theauthapi access key by id. Returns an empty 200 response on success. Required: id. - **Update a The Auth API access key reactivate by ID** (Update). Reactivate a deactivated access key in theauthapi. Returns a 200 response on success. Required: id. - **List all The Auth API projects** (List). List projects in theauthapi for a specific account. Returns: id. Required: accountId. - **Create a The Auth API project** (Create). Create a new project in theauthapi. Returns: id. - **Get single The Auth API project by ID** (Get). Get a single theauthapi project by id. Returns: id. Required: id. - **Update a The Auth API project by ID** (Update). Update an existing theauthapi project by id. Returns: id. Required: id. - **Delete a The Auth API project by ID** (Delete). Delete a theauthapi project by id. Returns: id. Required: id. - **List all The Auth API user roles** (List). List all user roles in theauthapi. Returns a collection of user role objects including id and attributes. Optional: accountId to filter results by account. - **Update a The Auth API user role by ID** (Update). Update roles for a specific user in theauthapi. Returns the updated user role record including id and attributes. Required: id. - **Delete a The Auth API user role by ID** (Delete). Delete roles for a specific user in theauthapi. Returns an empty 204 response on success. Required: id. - **List all The Auth API webhooks** (List). List webhooks in theauthapi filtered by account, project, and topic. Returns: id, accountId, projectId, topic. Required: accountId, projectId, topic. - **Create a The Auth API webhook** (Create). Create a new webhook in theauthapi. Returns: id, accountId, projectId, topic. Required: accountId, projectId, topic. - **Get single The Auth API webhook by ID** (Get). Get a single theauthapi webhook by id. Returns: id, accountId, projectId, topic. Required: id. - **Update a The Auth API webhook by ID** (Update). Update an existing theauthapi webhook by id. Returns: id, accountId, projectId, topic. Required: id. - **Delete a The Auth API webhook by ID** (Delete). Delete a theauthapi webhook by id. Returns an empty 204 response on success. Required: id. - **Create a The Auth API webhooks ping** (Create). Send a test ping to a theauthapi webhook endpoint to verify connectivity and confirm the webhook is reachable. Returns an empty 200 response on success. - **List all The Auth API webhooks topics** (List). List all available webhook topics in theauthapi. Returns the collection of webhook event topics that can be subscribed to. The response shape is not enumerated in the upstream documentation. - **List all The Auth API accounts** (List). List all accounts in theauthapi. Returns: id. - **Create a The Auth API account** (Create). Create a new account in theauthapi. Returns: id. - **Get single The Auth API account by ID** (Get). Get a single account by id from theauthapi. Returns: id. Required: id. - **Update a The Auth API account by ID** (Update). Update an existing account by id in theauthapi. Returns: id. Required: id. - **Delete a The Auth API account by ID** (Delete). Delete an account by id from theauthapi. Returns an empty 204 response on success. Required: id. - **Create a The Auth API account user** (Create). Invite a user to a theauthapi account by account id. Returns an empty 201 response on success. Required: id. - **Create a The Auth API auth signup** (Create). Create a new user account in theauthapi by signing up with a JSON body following the UserSignupDto schema. Returns an empty 201 response on success. - **Create a The Auth API auth add user from firebase** (Create). Add a user to theauthapi from a Firebase account by posting Firebase user credentials as a JSON body. Returns an empty 201 response on success. - **Create a The Auth API auth login** (Create). Authenticate a user in theauthapi by submitting login credentials as a JSON body. Returns a 201 response on success. The response body is not enumerated in the upstream source. - **Create a The Auth API auth email otc** (Create). Create and send an email one-time code (OTC) via theauthapi to initiate email-based authentication. Returns an empty 201 response on success. Required: email. - **Create a The Auth API auth validate login code** (Create). Validate a login code in theauthapi. Returns an empty 201 response on success. - **Create a The Auth API auth refresh access token** (Create). Refresh an access token in theauthapi by posting a user access token payload. Returns a 201 Created response on success. Required: a valid user access token body (UserAccessTokenDto). - **Create a The Auth API auth authenticate** (Create). Authenticate with theauthapi to verify credentials and obtain access. Returns a 201 response on success. No specific request body fields or response fields are documented by the upstream source. - **Update a The Auth API user by ID** (Update). Update an existing user in theauthapi by id. Applies a partial JSON patch to the user record and returns a 200 response on success. Required: id. - **List all The Auth API API keys** (List). List API keys in theauthapi. Returns: key, name, projectId, isActive, customAccountId, customUserId. Optionally filter by projectId, name, customAccountId, customUserId, or isActive. - **Create a The Auth API API key** (Create). Create a new API key in theauthapi. Returns: key, name, projectId, isActive, customAccountId, customUserId. - **The Auth API API keys list 2** (List). Look up a theauthapi API key by its key string value. Returns: key, name, projectId, isActive, customAccountId, customUserId. Required: key. - **Update a The Auth API API key by ID** (Update). Update an existing theauthapi API key by id. Returns: key, name, projectId, isActive, customAccountId, customUserId. Required: id. - **Delete a The Auth API API key by ID** (Delete). Delete a theauthapi API key by id. Returns an empty 200 response on success. Required: id. - **Get single The Auth API API key by ID** (Get). Get a single theauthapi API key by id. Returns: key, name, projectId, isActive, customAccountId, customUserId. Required: id. - **List all The Auth API API keys auths** (List). Authenticate a theauthapi API key using the legacy GET endpoint (authenticateKeyLegacy). Returns a 200 OK response on success. Required: key. - **Create a The Auth API API keys auth** (Create). Authenticate a theauthapi API key via POST (authenticateKey). Returns a 200 OK response on success. Required: id. - **Get single The Auth API API keys auth by ID** (Get). Authenticate a theauthapi API key by id using GET. Returns a 200 OK response on success. Required: id. - **Update a The Auth API API key reactivate by ID** (Update). Reactivate an API key in theauthapi by its key identifier. Returns a 200 response on success. Required: id. - **Create a The Auth API API key rotate** (Create). Rotate an API key in theauthapi by its key id. Returns a 201 response on success; the response body is not documented by the source. Required: id. - **List all The Auth API analytics project totals** (List). List analytics project totals in theauthapi for a specific project and date grouping. Returns aggregated analytics totals data for the project (the upstream source documents a 200 response but does not enumerate specific response fields). Required: projectId, dateGrouping. - **List all The Auth API analytics API key totals** (List). List API key usage totals from theauthapi analytics, grouped by a specified date period. Returns aggregate analytics data for the given project (response fields are not enumerated in the source documentation). Required: projectId, dateGrouping. - **List all The Auth API notifications** (List). List notifications in theauthapi. Returns a collection of notification records; the source documents only a 200 response with no additional field details. Returns: id. - **List all The Auth API invitations** (List). List invitations in theauthapi. Returns: id, accountId, projectId, status. Optionally filter results by accountId, projectId, or status. - **Create a The Auth API invitation** (Create). Create a new invitation in theauthapi. Returns: id, accountId, projectId, status. - **Get single The Auth API invitation by ID** (Get). Get a single invitation by id in theauthapi. Returns: id, accountId, projectId, status. Required: id. - **Update a The Auth API invitation by ID** (Update). Update an existing invitation by id in theauthapi. Returns: id, accountId, projectId, status. Required: id. - **Delete a The Auth API invitation by ID** (Delete). Delete an invitation by id in theauthapi. Returns an empty 204 response on success. Required: id. - **Create a The Auth API invitation accept** (Create). Accept a theauthapi invitation by id. Returns an empty 201 response on success. Required: id. - **List all The Auth API invitation info** (List). Get information about a specific theauthapi invitation by id. Returns: id and invitation-specific attributes. Required: id. - **List all The Auth API teammates** (List). List teammates in theauthapi. Returns a collection of teammate objects; the exact response fields are not enumerated in the source documentation. Optionally filter results by accountId or projectId.