Authentication and access management

Authorize a custom connector

When customer MCP OAuth is enabled for your account, add https://api.medianfi.com/api/v1/mcp as a custom connector in Claude or as a custom app in a ChatGPT workspace that allows it. Sign in to Median and authorize the company shown on the consent screen. Client and workspace availability can vary.

1. In Claude, open Settings, then Connectors, then Add custom connector.
2. Enter the Median MCP endpoint and continue to Connect.
3. Sign in to Median, check the company, and authorize read-only access.
4. In Median Settings, open Integrations and find Connected apps. Choose Revoke beside a grant to remove that OAuth access. You can also remove the connector in its client settings.

Use an MCP key

If the MCP OAuth flow is unavailable for your account, an owner or admin can open Median Settings, then Integrations, and choose Generate MCP key. Copy the key when it is created and store it securely. Median displays active MCP keys in the MCP server card under Active connections.

An owner or admin can revoke an MCP key from Active connections. OAuth grants appear separately under Connected apps.

REST report API access

For REST reports, use the company-scoped API key provisioned by Median with the reports:read scope. Do not use an MCP OAuth token as a REST credential.

Protect credentials

• Never put a key in a URL, browser bundle, source repository, or shared prompt. Send it only over HTTPS in the header required by that connection.
• A credential is limited to its company and scopes. A request for another company or a resource outside the key’s scopes is denied.
• Revocation prevents future access through that grant or key. It does not delete data an AI client already received.