API access & external apps
Set up API access for staff: issue API keys and connect AI clients via the MCP connector over OAuth
→ Open API access in SimpliServ
If you want to connect SimpliServ with your own scripts, external services or an AI client like Claude, you need credentials that work independently of your personal login. SimpliServ has two ways for this: API keys (bearer tokens for the REST API) and the MCP connector (an OAuth connection for AI clients). You'll find both in the administration area under Users & roles and on the Connectors page of the integrations area.
API access controls machine access. Whom you invite as a person and which roles exist is set under Users & roles. API keys and MCP connections draw on exactly the same roles.
Where to find access
In the administration area, open the integrations area. The Connectors page shows tiles for all available connections. For developer access, two of them are relevant:
- API Keys — issues bearer tokens for the REST API, e.g. for your own tools, webhooks or server-to-server integrations.
- MCP Connector — connects MCP-compatible AI clients (Claude Desktop, Claude (Web), ChatGPT, Cursor, etc.) to your workspace via OAuth.
Click a tile to open it. Each tile has the tabs Installation, Configuration and Permissions; if the connection is already active, the Overview tab is added. Creation and management always happens in the Configuration tab.
Create an API key
An API key is a token linked in the background to its own service account. This account gets the roles you select — so the key can do exactly what those roles allow, and no more.
Open the configuration
Open the API Keys tile and switch to the Configuration tab. You see the table of existing keys with the columns Name, Roles, Last used, Expires and Created. Click New integration.
Name the key and assign roles
Fill in the form:
- Name (required) — e.g. the name of your tool or the external app.
- Description — optional free text for what the key is intended for.
- Roles (required, multiple possible) — determines the key's permissions.
- Expires on — an optional expiry date; leave empty for no expiry.
- Disabled — turns the key off without removing it.
You can only give a key roles whose permissions you have yourself. If you choose a role with broader rights, SimpliServ refuses to save.
Copy the token
After saving, SimpliServ shows the token exactly once. Copy it immediately via the Copy token button and store it securely in your application — afterwards it can't be viewed again. If it's lost, disable the old key and create a new one.
You can edit existing keys at any time by clicking the table row: change roles, adjust the expiry date or turn it off via the Disabled toggle. A disabled key is marked in the table next to the name with the red Disabled badge.
Work against the API with the token
Send the token as a bearer token in the Authorization header of every request:
Authorization: Bearer <your-token>Which endpoints are available, which fields they expect and which filters they support is in the API reference.
API reference
Full endpoint documentation of the REST API.
WordPress plugin
A ready-made integration that uses an API key.
Connect AI clients via MCP
The MCP connector exposes your workspace as an MCP server at /api/v1/mcp. AI clients connect to it via OAuth 2.1 with PKCE — you need no manually issued token for this. A detailed guide for the individual clients is under MCP.
Add the server in the client
In the MCP client, add a new server with the URL https://<your-domain>/api/v1/mcp and choose OAuth as the authentication method. The Installation tab of the MCP tile shows ready-made guides for Claude Desktop, Claude (Web), ChatGPT, Cursor and other clients.
Grant consent
On first connecting, the client redirects to the consent screen (/oauth/consent). If you're not signed in there yet, sign in first with your workspace user. The screen shows the requesting client, its client ID, the redirect and the permissions it receives. Confirm with Allow or refuse with Deny.
Manage clients
In the Configuration tab of the MCP tile, Authorized OAuth clients lists every connected client with the columns Client, First authorized, Last used and Expires. Via Revoke you disconnect a client immediately and invalidate all issued access tokens.
An MCP connection inherits the workspace roles valid at sign-in. The client confirms every write operation before executing it, and you can revoke the connection from the list at any time.
Security
- Tokens are as powerful as their roles. Assign a dedicated, as narrowly scoped role as possible per integration instead of a general-purpose key.
- Set an expiry date if access is only needed for a limited time.
- Block immediately if a token or client might be compromised — disable the API key or revoke the OAuth client.
- Never keep tokens in plaintext in repositories or shared documents.
You'll find further organisation-wide safeguards under Security settings.
Related topics
- Manage connectors — the hub where API Keys and the MCP Connector live as tiles
- MCP — connect AI clients via OAuth and manage authorized clients
- Connect ChatGPT — step-by-step walkthrough for ChatGPT
- Connect Claude – step-by-step walkthrough for Claude
- Users & roles — the roles a key or MCP connection takes on
- Security settings — enforce two-factor authentication organisation-wide
- WordPress plugin — a ready-made integration that uses an API key
How is this guide?