Authentication
How AI assistants sign in to the Stacksync MCP, how long sessions last, and when to use API keys
Sign in with your Stacksync login
The Stacksync MCP uses OAuth. The first time your assistant uses the server, it opens the Stacksync sign-in page:
- Sign in with your Stacksync login, as in the Stacksync app.
- Choose a default workspace. Your assistant uses it for requests that don't name a workspace.
- To grant read-only access, clear Make changes. Your assistant can then read your resources but not change them.
Your permissions, nothing more
Your assistant acts on your behalf, with your role in each Stacksync workspace you belong to. It sees only the resources and data you can see in the Stacksync app. Workspace owners can limit it further with governance settings and MCP Gateway Policies.
One server URL serves all your workspaces, in every Stacksync region.
Sessions
Your assistant stays signed in. You sign in again only after 30 days of inactivity, and at least every 90 days.
The Sessions tab of the MCP page lists the assistants you have signed in, with their last activity. Select Revoke to end a session immediately.
API keys
Use an API key instead of signing in when no person is present to sign in: scripts, CI pipelines, and MCP clients without OAuth. Send the key in the Authorization header:
Authorization: Bearer <api-key>Stacksync has two types of API keys:
| User API key | Workspace API key | |
|---|---|---|
| Acts as | You | The workspace, with the workspace owner's role |
| Workspaces | Every Stacksync workspace you belong to, with your role in each. When you belong to several, the request names the workspace. | Only the workspace that created it |
| Where to create it | Your Profile page, under Stacksync User API Key. Each user has one key, and regenerating it replaces the old one. | Workspace settings → Security & API keys |
| MCP Gateway Policies | The policies that include you. Workspace owners are never limited. | The policies that apply to All workspace users |
| Rate limit | 120 tool calls per minute, shared with your signed-in assistants | 120 tool calls per minute for each key |
| Shown in activity as | You | The API key |
An API key can read and make changes, with no read-only option. When Ask before every change is on, changes made with an API key also wait for acceptance. Learn more.
Keep API keys secret: anyone with a key can act with its access. Use sign-in for AI assistants that people use directly.