MCP for your users
Give each of your users an MCP key bound to their own account, minted through the API or a hosted connect session.
For platforms whose users connect a mailbox and want to use it from their own AI assistant. Your users have no console login, so they cannot sign in with OAuth; give each one an MCP key instead.
MCP keys
An MCP key is bound to one connected account and works only at https://api.workwae.com/mcp. Anywhere else it answers mcp_only_key (403), so handing it to a user's AI assistant exposes that one mailbox and nothing else.
There are two ways to mint one:
- Through the API, when you already have the account.
- From a hosted connect session, so the user gets the key right after connecting their mailbox.
Mint a key through the API
curl -X POST "https://api.workwae.com/v1/accounts/$ACCOUNT_ID/mcp-keys" \
-H "Authorization: Bearer $WORKWAE_API_KEY" \
-H "content-type: application/json" \
-d '{ "name": "Claude", "scopes": ["read", "write"] }'The response carries the key once, with mcpUrl, the server the user sends it to as Authorization: Bearer <key>.
| Field | Meaning |
|---|---|
scopes | read, write and send, never admin. Leave out send to let the assistant draft but never send. |
name | Optional; defaults to MCP. |
expiresAt | Optional; left out or null, the key never expires. |
sendPolicy | Optional. Holds the key to a stricter send policy than the workspace's; it can only tighten it. |
- Minting, listing (
GET /v1/accounts/{accountId}/mcp-keys) and revoking (DELETE /v1/accounts/{accountId}/mcp-keys/{keyId}) take theadminscope and a key that is not limited to accounts. - An account holds at most 25 live keys; one more answers
mcp_key_limit(409). Deleting the account revokes them all. - The console's API keys page leaves these keys out. Each account's page lists them under MCP keys, where admins can revoke them too.
Every operation is in the MCP keys reference.
From a hosted connect session
Add mcp to POST /v1/connect-sessions (admin scope):
{ "mcp": { "scopes": ["read", "write"], "name": "Claude" } }The user connects their mailbox on the hosted connect page.
Workwae mints a key for that account and shows it once, on a Workwae page with the server URL, the key and setup steps for Claude Code, Cursor and Codex.
The user continues to your redirect URI.
- The key never appears in a URL, a webhook or the session's outcome:
GET /v1/connect-sessions/{sessionId}answers only itsmcpKeyId. - If the account already holds 25 live keys, it still connects but gets no key. The page says so, and the session answers
mcpKeyId: nullwithmcpKeySkipped: "mcp_key_limit". - Reloading the page does not show the key again. If the user lost it, mint another.
Which clients work
Any client that sends a header: Claude Code, Cursor, Codex and the like, configured as in Connect with an API key with the MCP key in place of the API key.
Claude.ai and ChatGPT custom connectors only sign in with OAuth, which needs a console login, so they cannot use MCP keys.