How the connection works.
No API key ever appears in a config file. Every client below authenticates the same way: a browser tab, a sign-in, and one click.
1. You add Ordel's MCP server
One command or config snippet points your client at https://ordel.io/api/mcp, the same URL for every client, and it never contains a token or secret.
2. The first tool call opens your browser
The client calls an Ordel tool, gets a 401, and follows the OAuth discovery Ordel publishes at its .well-known endpoints. It registers itself automatically (dynamic client registration) and opens Ordel's consent screen in your default browser.
3. You sign in and click Approve
The consent screen names the client (e.g. "Claude Code") and lists what it's asking for in plain words, read, write, or run access to your workspace. Approve issues the grant; the client stores it and never asks again for that session.
4. The client keeps itself connected
Each grant is a short-lived access token plus a refresh token, both held by the client, never typed or copied by you. The client refreshes automatically in the background for as long as it's actively used.
What's granted, and for how long
- The grant acts as you, it can see and do whatever your account can, scoped to what you approved on the consent screen.
- Access tokens last 30 minutes; refresh tokens last 30 days and roll forward every time the client uses them, so an agent you use regularly never interrupts you to re-approve.
- An agent that goes idle for about 30 days will ask you to approve again next time it calls a tool, a one-click browser prompt, not a re-setup.
- Multiple agents can be connected at once, each with its own grant, connecting Cursor doesn't touch Claude Code's connection, and revoking one doesn't affect the others.
Manage or revoke a connection any time from Account → API keys.