MCP Authentication

There are two ways to connect to the MCP server:

	OAuth sign-in	API key
Who it is for	ChatGPT, Claude and other AI apps a person uses	Your own agents and scripts
Plans	Every plan	Pro plan only
What the AI can do	What the person who signed in is allowed to do	What the key's scopes allow

Connect with OAuth (ChatGPT, Claude)

AI apps that support remote MCP servers with OAuth connect without an API key, on every EquipDash plan.

1. Add a remote MCP server (Claude calls it a custom connector) with this address:

   https://app.equipdash.com/mcp/v1

2. When the app asks you to sign in, sign in to EquipDash, pick the business, and click Allow.

The app then acts as you: each tool checks your own permissions in that business, so a staff login cannot do more through the app than it can in EquipDash.

Each tool also follows the business's plan, the same way EquipDash does. A tool for a feature the plan does not include is left out of tools/list, and calling it returns a JSON-RPC error that names the plan, for example Promotions is on the Growth plan.

The steps for ChatGPT, Claude and other apps are also in EquipDash under Settings > API & Integrations > AI apps, with a prompt you can paste into the app to set it up. Its Your AI apps list shows every AI app connected to the business, when it was last used, and a Disconnect button that stops it at once.

OAuth discovery and registration follow the MCP authorization spec:

• GET /.well-known/oauth-protected-resource
• GET /.well-known/oauth-authorization-server
• POST /oauth/register (dynamic client registration)

Access tokens last an hour and refresh tokens 30 days, so an app that is used at least once a month stays connected.

Connect with an API key (Pro plan)

The MCP server also accepts the same API keys as the REST API, with one additional requirement: the mcp:access scope. API keys need the Pro plan.

Requirements

Your API key must have:

1. mcp:access scope - Required for all MCP connections
2. Domain-specific scopes - Controls which tools are available (e.g., bookings:read for booking tools)

Without the mcp:access scope, the MCP server will reject the connection.

Creating an MCP API Key

1. Log in to your EquipDash dashboard
2. Navigate to Settings > API & Integrations
3. Click Create API Key
4. Select MCP Access and any additional scopes you need
5. Copy the key immediately (it won't be shown again)

Authentication Method

Include your API key in the Authorization header:

Authorization: Bearer eqd_live_your_api_key

Scope-to-Domain Mapping

The tools available to your AI agent depend on which scopes are granted to your API key:

API Scope	MCP Tool Domains
mcp:access	Required for all MCP connections
bookings:read	Bookings (read tools), Payments (read tools), Tags
bookings:write	Bookings (write tools), Payments (write tools)
products:read	Products, Bundles, Workshop, Categories (product)
products:write	Products (write tools), Categories (product write)
experiences:read	Experiences, Categories (experience)
experiences:write	Experiences (write tools), Categories (experience write)
customers:read	Customers (read tools)
customers:write	Customers (write tools)
staff:read	Staff (read tools)
staff:write	Staff (write tools)
store:read	Store (read tools), Categories (store)
store:write	Store (write tools), Categories (store write)
promotions:read	Promotions (read tools)
promotions:write	Promotions (write tools)
waivers:read	Forms (read tools)
waivers:write	Forms (write tools)
surveys:read	Surveys
reports:read	Reports
settings:read	Settings, Seasons

Recommended Setup

For a general-purpose AI assistant, create a key with mcp:access plus all read scopes. Add write scopes only if you want the AI to create or modify data.

Authentication Errors

Error Code	HTTP Status	Description
authentication_required	401	No API key or OAuth token provided, or the OAuth token is invalid, expired or disconnected
invalid_api_key	401	API key is invalid or expired
forbidden	403	An API key on a plan without API access (Pro only), an OAuth token that was not granted MCP access, or a tool for a feature the business's plan does not include
mcp_access_required	403	API key lacks mcp:access scope
insufficient_scope	403	API key lacks scope for the requested tool

Security Best Practices

• Use read-only scopes when your AI agent only needs to query data
• Rotate keys regularly and revoke unused keys
• Use separate keys for MCP and REST API access
• Enable IP whitelisting if connecting from known locations

Related

• REST API Authentication - General API key documentation
• MCP Quickstart - Configure your MCP client