Introduction

Authentication

The MCP server supports two authentication methods. Choose the one that fits your workflow.

MethodMCP Server URLBest for
OAuth (recommended)https://<your-ada-instance-domain>/api/mcp/oauthInteractive use with browser-based login
API Keyhttps://<your-ada-instance-domain>/api/mcpAutomated setups or programmatic access

Ada instance domain

Your Ada instance domain is the URL you use to log in to your Ada dashboard (for example, acme-corp.ada.support, acme-corp.eu.ada.support, or acme-corp.maple.ada.support).

If you log in at https://acme-corp.eu.ada.support, your MCP Server URL is https://acme-corp.eu.ada.support/api/mcp/oauth for OAuth or https://acme-corp.eu.ada.support/api/mcp for API key.

OAuth

OAuth uses browser-based login with your Ada credentials. No API key is required, and no secrets are stored in configuration files.

Use OAuth when:

  • Connecting an interactive AI assistant (Claude Desktop, ChatGPT, Gemini CLI).
  • You want access tied to an individual user account.
  • You want to avoid distributing long-lived credentials.

API key

API keys are generated from Config > PLATFORM > API Keys in your Ada dashboard. See Authentication for details on key management.

Use an API key when:

  • Running MCP clients in non-interactive environments (CI pipelines, scheduled jobs, backends).
  • Integrating programmatically with the Google Agent Development Kit (ADK).
  • Browser-based login is not available.
For security, store the API key as an environment variable rather than pasting it into configuration files.

Permissions

Tool access is governed by your Ada dashboard role:

Ada roleMCP access
OwnerAll tools, including writes
AdminAll tools, including writes
AgentRead-only tools
Read OnlyRead-only tools

propose_change is the only write tool exposed today. Calling a write tool as an Agent or Read Only user returns a permission error, and write tools are hidden from the assistant’s tool list for those roles.

Role changes apply on the next tool call — no reconnect required.

Role-based access applies to OAuth only. API key requests use a separate auth path scoped by the key’s permissions.