Authentication
API key and OAuth setup for the GetMint MCP server
There are two ways to authenticate to the GetMint MCP server, and they coexist — pick the one your client supports:
| Method | Best for | How you connect |
|---|---|---|
| API key | Claude Code/Desktop, Cursor, ChatGPT, the API, and any client that lets you set a request header | Paste a mint_live_ key as a Bearer header |
| OAuth | Claude.ai and ChatGPT custom connectors (web/desktop/mobile), where you connect by URL | Paste the server URL and click Connect — the client walks you through sign-in + consent |
Both grant the same access; OAuth never breaks existing keys. ChatGPT's UI supports either; Claude.ai is OAuth-only; header-based clients (Claude Code/Desktop, Cursor, Raw HTTP) are API key-only.
API key
The MCP server uses the same API keys as the REST API — one key reaches both the REST API and the full MCP toolset.
Header format
Use the Authorization: Bearer header (the MCP spec default):
Authorization: Bearer mint_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXThe X-API-Key header is also supported.
Claude Code
Add the server to your .mcp.json with the key in the Authorization header:
{
"mcpServers": {
"getmint": {
"type": "http",
"url": "https://mcp.getmint.ai/mcp",
"headers": { "Authorization": "Bearer mint_live_XXXXXXXX…" }
}
}
}OAuth (Claude.ai / ChatGPT custom connector)
Claude.ai connects over OAuth 2.1 (no place to paste a key); ChatGPT offers OAuth too. Add the connector with just the URL:
https://mcp.getmint.ai/mcpClick Connect: the client discovers the authorization server, sends you to sign in, and shows a consent screen. Approve it and the connector is ready — no key to manage.
Disconnect anytime from Settings → API Access → Connected Apps; revoking immediately invalidates its tokens, and the client must re-authorize to reconnect.
Only an organization Owner or Admin can authorize a connector — a connector token can read and write across all of your organization's data. Editors and Viewers will see a "you can't authorize this connection" screen; ask an owner/admin to set it up.
The connector requests read access to Insights and read/write access to Content Studio. The consent screen lists exactly what's requested before you approve, and the token is audience-bound to this MCP server.
This follows the MCP authorization spec (OAuth 2.1 with PKCE, Dynamic Client Registration, per-resource audience binding), so it works from any spec-compliant client, not just Claude.
Key management
MCP keys can trigger credit-consuming actions (brief creation, content generation). Treat them like production secrets.
- One key per integration — revoking a shared key breaks every caller.
- Never commit keys. Use your OS keychain, a secrets manager, or a git-ignored
.env.local. - Rotate immediately on exposure from Settings → API Keys; the old key dies the moment you revoke it.
- Use
mint_test_keys while prototyping — they run against the test environment with sandbox credits.
Rate limits
MCP calls count against the same 200 req/min per key as REST. A tool call is typically one request, so MCP doesn't multiply your budget.