MCP

Connect a client

One hosted connector at app.curviate.com/mcp. Paste the URL, sign in, approve once. No code, no key to copy.

Claude or ChatGPT in two steps

1. Add a custom connector and paste this URL.

https://app.curviate.com/mcp
  • Claude: Settings, Connectors, Add custom connector.
  • ChatGPT: Developer mode, Plugins, New connector.

2. Sign in and approve once. Curviate signs you in, so there is no API key to copy. Revoke access anytime from your dashboard. Which tools appear once connected: Toolsets.

Terminal agents

Each block below gives the OAuth command and, for unattended use, the API key form. Snippets that use a key read it from the CURVIATE_API_KEY environment variable.

Claude Code

Auth: OAuth or Bearer header. Plan gate: none.

OAuth:

claude mcp add --transport http curviate https://app.curviate.com/mcp

Then run /mcp in Claude Code, select curviate, choose Authenticate, and approve access in the browser.

API key:

claude mcp add --transport http curviate https://app.curviate.com/mcp \
  --header "Authorization: Bearer $CURVIATE_API_KEY"

Your shell expands $CURVIATE_API_KEY when you run the command, so the key itself is written to Claude Code's config. Check either setup with claude mcp list: curviate reads Connected.

Codex

Auth: OAuth or Bearer header. Plan gate: none.

OAuth:

codex mcp add curviate --url https://app.curviate.com/mcp

Codex detects OAuth support and prints an authorization URL; open it, sign in to Curviate, and approve access. To sign in again later, run codex mcp login curviate.

API key, with the key read from the environment each time Codex connects:

codex mcp add curviate --url https://app.curviate.com/mcp \
  --bearer-token-env-var CURVIATE_API_KEY

Both write to ~/.codex/config.toml:

[mcp_servers.curviate]
url = "https://app.curviate.com/mcp"
bearer_token_env_var = "CURVIATE_API_KEY"   # API key setup only

codex mcp list shows the server and its auth (OAuth, or the variable name). If CURVIATE_API_KEY is not set, Codex refuses to start the server and names the missing variable.

Gemini CLI

Auth: OAuth or Bearer header. Plan gate: none.

OAuth:

gemini mcp add --transport http curviate https://app.curviate.com/mcp

Then start gemini, run /mcp auth curviate, open the printed URL, sign in to Curviate, and approve access.

API key:

gemini mcp add --transport http curviate https://app.curviate.com/mcp \
  -H 'Authorization: Bearer ${CURVIATE_API_KEY}'

Keep the single quotes: Gemini CLI stores ${CURVIATE_API_KEY} as written and fills it from the environment when it connects, so the key stays out of the settings file.

gemini mcp add writes to the project's .gemini/settings.json (add --scope user for every project). Check with gemini mcp list: curviate reads Connected. Gemini CLI does not start MCP servers in a folder you have not trusted; there the server reads Disabled.

A client that is not listed

Any client that speaks remote Streamable HTTP can connect: try OAuth with the bare URL first, then the Authorization: Bearer header (see Authentication). A client that only speaks stdio is not supported. If a client connects but its tool calls fail with 401, see Troubleshooting.

Authentication

Use OAuth wherever the client supports it, a header where it does not, and the query parameter only when the client can set no header at all.

MethodHowUse it when
OAuth 2.1Add the bare URL https://app.curviate.com/mcp. The client discovers the authorization server, opens a browser, and you approve access.The client supports OAuth. Always the first choice.
Bearer headerSend Authorization: Bearer cvt_live_YOUR_KEY on every request.The client can set a header but has no OAuth, or runs unattended (CI, a server-side agent).
?token=https://app.curviate.com/mcp?token=cvt_live_YOUR_KEYThe client can set neither OAuth nor a header. Last resort.

OAuth

  • No key leaves the dashboard. You sign in to Curviate in the browser and approve the client on a consent screen; the client receives its own tokens.
  • The client refreshes its access silently. You normally sign in once per client.
  • Every approved client is listed in the dashboard under Settings › Profile, Authorized applications, with the date it was granted. Revoke ends that client's access at once; it has to sign in again to reconnect. Revoking one client leaves your API key and every other client untouched.
  • An approved client gets full access to the workspace, the same as the API key: every connected LinkedIn account and every action.

API key: Bearer header or ?token=

The key is the same cvt_live_ team API key the REST API and CLI use. Copy it under Settings › API & Webhooks in the dashboard (Quickstart).

The API key is a full-access workspace credential. Anyone holding it can act on every LinkedIn account connected to the workspace. So:

  • Prefer OAuth for a connector whenever the client supports it. A leaked OAuth grant is revoked per client; a leaked key has to be rotated everywhere it is used.
  • Keep the key in an environment variable (CURVIATE_API_KEY) and reference the variable from the client config, never the literal key.
  • A ?token= URL carries the key in plain sight: in the client's settings, in screenshots, in shared config. Use it only when no header is possible. Curviate strips the parameter from the URL before anything downstream sees it.
  • If a request carries both a header and ?token=, the header wins.

Rotate or revoke the key from the key control's menu. Rotation breaks every client configured with the old key; OAuth clients are unaffected.

Unauthenticated requests

A request with no credential, or a wrong or revoked one, gets 401 with a WWW-Authenticate: Bearer resource_metadata="https://app.curviate.com/.well-known/oauth-protected-resource/mcp" header. That header is what OAuth-capable clients use to start sign-in, and the 401 (rather than a 404) is how you know you reached the server. Fixes: Troubleshooting.