Setup and sign-in.

The address

https://api.stablebaseline.io/functions/v1/cloud-serve/mcp

One address for every tool, over streamable HTTP. A tool that has to use a local bridge can still reach it; the recipes show how for each tool.

Sign in with OAuth

Where your tool supports it, signing in is the simplest choice: no key to copy or keep safe, and you can revoke it from your settings at any time.

1. 1

   Add the address to your tool, without a key

   Your tool notices it needs to sign in and opens your browser.
2. 2

   Sign in to Stable Baseline

   With your password and two-factor code, Google, or single sign-on.
3. 3

   Choose what it may do

   Pick the organisation, name the connection, and choose its access: the same choices as for an API key, below.
4. 4

   Authorise

   The tool is connected. Revoke it from your organisation settings whenever you like.

Expand

For tool builders

Clients can register themselves, or use a client metadata document as their client id, and sign in with PKCE. The only scopes are openid, profile, email and phone: they identify the person. What the tool may do is chosen on the consent screen, not by scopes.

Use an API key

1. 1

   Open Developers

   In Organisation settings, under Connected apps, open Developers and the API keys tab. Workspaces and projects have their own Developers page too, for keys that only reach them; a key locked to a project needs admin access to it.
2. 2

   Create Key

   Name it after where it will run, such as “Build pipeline” or “Ana's laptop”, and choose when it expires: never, or after 7, 30 or 90 days, or a year.
3. 3

   Choose its access

   Where it can work: everywhere, or only some workspaces, projects or folders. What it can do there: Documents, Whiteboards, Plans and tasks, Improvements, and Databases and dashboards, each at Read, Edit or Delete. Whether it may use or set up your agents, and, for owners and admins, any tasks that run the organisation. In short shows what you are giving before you save. Databases and dashboards start out of reach: give them a level if the key needs them. See Permissions.
4. 4

   Copy the key

   It starts with sta_ and is shown once. Keep it in your tool's secret store.

Expand

Send the key with every request, either way:

Authorization: Bearer sta_your_key_here

x-api-key: sta_your_key_here

Check it works

Ask your tool something only a working connection can answer:

Which Stable Baseline workspaces and projects can you see?

If it cannot see what you expect, check the key's or the connection's scope first, then its permissions.

When a tool spends money or credits

Changing a plan or seats, cancelling, buying credits, changing what the company brain reads or rebuilding it, and premium whiteboard designs all take two steps. The first call returns what will happen and a token; only a second call with that token does it. A token works once, for ten minutes, so a tool always shows you the cost before anything is spent, and a retry never charges twice. Switching the company brain on also waits until an owner or admin has accepted the Brain terms in the app.

Limits

• Database tools pace the requests of each key, sign-in or agent, and allow short bursts. A busier call waits its turn rather than failing; only after a long wait does it say the service is busy, so the tool can try again later.
• One request can carry up to 50 messages.