HOC SiteDocumentation

Connect and authenticate

Three ways to authorize MCP requests — OAuth through a browser session, an API key sent as a bearer token, or a short-lived access token from the login tool.

MCP uses your existing platform account. There is no register flow, and MCP cannot create an account for you.

OAuth

Most MCP clients support OAuth. The client opens a browser session, you sign in with your platform email and password, and the client receives a token it can refresh on its own. This is the path to prefer: no secret is copied into a config file.

API keys

Create an API key in your account settings and send it as Authorization: Bearer <key>. API keys are the right choice for clients that cannot complete a browser flow, such as a server-side automation.

Keys are per user, not per website. A key can reach every website your account can already open, so treat it like a password and rotate it if it leaks.

The login tool

login takes your platform email and password and returns a one-day access token. Use it when a client has no OAuth support and you do not want to store an API key. When the token expires, call login again.

login is registered only while the session has no token, so you will not see it in the tool list once you are authenticated.

What a token can do

A token carries your permissions, not a separate agent permission set. Website access, object permissions, and role slices all apply exactly as they do in the admin panel. A tool that writes something you cannot write in the panel returns forbidden.

401 unauthorized means the token is missing, expired, or invalid. 403 forbidden means the token is valid but the account lacks the website or role permission; signing in again will not change it. Check the website access and role grants instead.