Skip to main content

Credentials and security

Prefer UniPost's browser authorization flow for MCP clients that support OAuth. Owners and admins select the workspace an agent may use and approve that connection.

OAuth connections​

UniPost uses OAuth with PKCE. Access tokens expire after 24 hours; clients with refresh-token support can renew them. If a client cannot renew access, reconnect through its authorization flow.

The connection is scoped to the selected workspace. Changing the active workspace in your dashboard does not move the connection to another workspace.

Review connected agents in API keys. Revoke a connection there when it is no longer needed.

API key fallback​

If your MCP client cannot complete OAuth, a workspace owner or admin can create a key under API keys.

  1. Select the intended workspace.
  2. Create a key with a name identifying the client or integration.
  3. Copy the full key when it is shown. UniPost shows it only once.
  4. Configure the client to send it to the UniPost MCP server as a bearer credential:
Authorization: Bearer <your-api-key>

Keep the key in the client's credential storage. Do not put it in public examples, shared chat transcripts, repository files, or logs. UniPost stores credential hashes, and the key cannot be recovered later; replace it if you lose it.

What agent access permits​

MCP credentials provide workspace posting and analytics tools, including tools that approve publication and delete unpublished groups. Ask your client to require your approval before actions that publish or delete content.

Profiles within a workspace organize connections; they do not limit an agent to one brand or client. Use separate workspaces and separate authorizations when you need a separate scope.

Revoke or replace access​

Revoke the relevant key or connected agent in API keys. If a credential may have been exposed, revoke it and configure a replacement in the client. Do not share the exposed value when asking support for help.

Payment authorization is separate​

An MCP connection does not give an agent your signed-in billing browser session or permission to spend from a wallet. A payment wallet also does not grant UniPost workspace access.

Follow agent payments for buyer authorization and recurring charges. Keep wallet and Stripe payment credentials inside that payment flow.

See UniPost's Privacy Policy and Support for account and data questions.