Authentication

Every MCP request must carry your Profundis credential. The server forwards it to the Profundis API, which authenticates the call and bills your credits. You can authenticate two ways. One-click OAuth is recommended (nothing to copy, store, or rotate); an API key is there for scripts and headless clients. Either way it ends up as a single Authorization: Bearer <credential> header.

Who can connect

You need a paid plan (Solo or Professional) or unused credits from a credit pack, the same rule as the API. The monthly credits of a Free account don't count.

A Free account without credit-pack credits can't create an API key. It can still complete the OAuth sign-in, but every search then fails with an insufficient credits error (402, Q2014) until you buy a credit pack or upgrade. The check runs on each call, so a Free account that has spent its pack credits is blocked again until it buys more.

Option 1: OAuth (one-click, recommended)

Clients that support remote MCP connectors (Claude.ai and Claude Desktop, ChatGPT, and Claude Code) let you connect without copying a key. You add the server URL, the client discovers the Profundis authorization server, and you sign in once; it then receives and refreshes its own access token. This is the recommended path: nothing to paste, store, or rotate, and you can revoke it per-client.

The flow is standard OAuth 2.1 with PKCE:

1. You add https://mcp.profundis.io as a custom connector in your assistant (or, in Claude Code, run /mcp then Authenticate).
2. The assistant reads the server's protected-resource metadata and is redirected to the Profundis authorization server.
3. You sign in to Profundis (Google sign-in) and approve the connection.
4. The assistant stores the access token and uses it for every tool call.

You can review and revoke connected apps at any time from your account profile. Revoking a connection immediately invalidates its tokens.

Option 2: API key (bearer token)

For scripts, CI, or any headless client, create a named personal API key in your account profile and use it as the bearer token. You can have five active keys. Choose an expiration of 1–365 days or no expiration. Creating or rotating a key requires authentication within the last five minutes.

Save the secret when it appears: it is shown once, and the profile cannot retrieve it later. Rotation replaces only the selected key. The default zero-hour overlap invalidates the old key immediately; an overlap of up to 24 hours lets you update the client first, unless the old key expires earlier. Both keys count toward the active-key limit during overlap. See Generate a token for the full procedure.

The client sends:

Authorization: Bearer <YOUR_API_KEY>

caution

Treat the key like a password. Anyone holding it can spend your credits. Revoke it or rotate it with zero overlap from your profile if it leaks.

Which one should you use?

Client	Recommended
Claude.ai and Claude Desktop	OAuth (one-click)
ChatGPT	OAuth (one-click)
Claude Code	OAuth; an API key for headless / CI
Other MCP clients	OAuth if supported, otherwise an API key

Either way, billing and access limits are identical: the credential resolves to your account and your credits are charged server-side.