Authorization
What the consent screen asks, scoping a URL to one project, and what to do when a client won't authorize.
Setting a client up is two halves: the server entry (covered by the tabs on the MCP page) and the browser sign-in. This page is the second half: the same two screens whichever client sent you there.
What the authorization page asks
Whichever client you started from, the browser flow is the same two screens:
Sign in
If you aren't signed in to Saasco already, you sign in first, with the same account you use for the dashboard.
Confirm
The screen names the application, the address it sends you back to, and what it will be allowed to do across the projects you belong to. Allow access hands the client its token; Cancel sends it away with nothing.
A client picks its own display name when it registers, so a name alone is not proof of who is asking. The address you'll be sent back to is the part an impostor cannot choose freely. Check it matches the tool you're actually setting up.
First things to try
The agent picks the tools; you just describe the job. A read-only connection can already answer:
- "How many contacts did we add this week, and where did they come from?"
- "Show me everything
ada@example.comhas done in the product." - "Group the open support conversations by theme and tell me the three biggest."
- "Which help centre articles mention the new pricing?"
- "What's our usage this month against the plan?"
With write access it can also act on the answer: "add everyone who hit the pricing page twice this week to the Warm list", or "draft a help centre article from these three support threads". The tool reference is the full surface.
Scope an entry to one project
The account URL reaches every project you belong to. To pin an entry, put the project id on its URL. Two entries are two servers, so an agent can tell them apart from the URL alone:
{
"mcpServers": {
"saasco": { "url": "https://www.saasco.com/api/mcp" },
"saasco-acme": {
"url": "https://www.saasco.com/api/mcp?projectId=YOUR-PROJECT-ID"
}
}
}Sign-in is still your account. The query parameter is what limits that entry's tools.
Troubleshooting
No tools listed. The client is connected but not authorized yet. Re-run its sign-in step. In Claude Code and Gemini CLI that's /mcp; in Cursor it's the Needs login badge in Settings → MCP.
Only saasco_search_tools, saasco_execute_tool, and read_saasco_documentation are listed. That's the default. The agent finds a tool with saasco_search_tools, runs it with saasco_execute_tool, and reads these docs with read_saasco_documentation. To list every tool instead, add codemode=off to the server URL and reconnect.
A write tool is missing. Connections start read-only. The write half of the surface appears once the connection holds mcp:write; re-authorize and check that the consent screen lists "Create and change data in your projects".
The client can't do OAuth. There is no header or API-key alternative. A Saasco API key is rejected by /api/mcp, and an MCP token is rejected by the REST API. Put mcp-remote in front of it instead, as in the Other clients tab; it runs the browser flow and hands the client a plain stdio server.
It stopped working. Check Account → Connected apps. A connection disappears from that list when it is revoked. Reconnect from your client to get a new one. If you were removed from a project, that project drops off the connection and the rest stay.
Wrong project on a scoped URL. The project id is part of the server URL. Change ?projectId= and reconnect. An account URL (/api/mcp with no query) reaches every project you belong to, and the tools take projectId.