Skip to main content
You connect an AI app to SmartAlex by signing in, not with a key. Paste https://mcp.getsmartalex.com into the app, sign in to SmartAlex in your browser, and press Allow. The app never sees your password, and nothing secret is saved in your files.

​
What the sign-in gives the app

The app works as you:
  • in the workspace you last opened in SmartAlex
  • with your role’s permissions, and only the tools your plan and add-ons include
  • until you sign it out from Account → Security → Where you’re signed in
Security and permissions covers this in full, including the actions that ask you first.

​
How the sign-in works

The server uses OAuth with the standard discovery flow, so a compliant AI app sets itself up from the address alone: Under the hood:
  • Protected-resource metadata (RFC 9728) is served at /.well-known/oauth-protected-resource, so the app discovers where to sign in.
  • Authorization-server metadata (RFC 8414) is served at /.well-known/oauth-authorization-server, advertising the authorize and token endpoints, dynamic client registration, and PKCE (S256, required).
  • A missing or invalid token returns 401 with a WWW-Authenticate header pointing back to the metadata, which is how the app knows to start the sign-in.

​
When the sign-in stops working

​
API keys

API keys (sa_live_ and sa_test_) are not available to customers. Connect by signing in instead. The older local npm package needs a key, so it is not the way to connect.

​
Rate limits

Over the limit returns 429 with a Retry-After header and X-RateLimit-* headers. Well-behaved apps back off automatically.

Security and permissions

What a signed-in app can do, and how to disconnect it.

Error reference

Every sign-in and rate-limit error, with fixes.