---
title: "Authentication"
description: "Connect with OAuth or an MCP key, choose scopes, and understand who can read and who can change data."
url: "https://sellify.ai/docs/developers/authentication"
---

# Authentication

> Connect with OAuth or an MCP key, choose scopes, and understand who can read and who can change data.

Every request to the Sellify MCP server is authenticated, and every connection acts as one person in one workspace. There are two ways to authenticate.

| Method            | Best for                                                                                                           |
| ----------------- | ------------------------------------------------------------------------------------------------------------------ |
| **OAuth sign-in** | AI tools and clients that can open a browser window. The person signs in, picks a workspace and allows the scopes. |
| **MCP key**       | Scripts, servers and tools that can only send a header.                                                            |

## Use an MCP key

Create a key in **Settings → MCP keys**, then send it on every request as a bearer token:

```text
Authorization: Bearer sfy_mcp_your_key_here
```

A key acts as the person who created it, in the workspace they created it in. It stops working if they leave that workspace. Sellify shows the key once, so copy it when you create it.

When you create a key you choose:

- **Scopes.** What the key can do. **Ad Spy: read** and **Ads: read** are ticked to start with.
- **Daily credit limit.** The most credits the key can use in a day. It starts at 500 and can be 1 to 10,000.
- **Expiration.** No expiration, 30 days, 90 days or 365 days.

Scopes cannot be changed on an existing key. To change them, create a new key and revoke the old one.

## Use OAuth

OAuth connections use the same address, `https://app.sellify.ai/api/mcp`. Point an OAuth-capable client at it and the client discovers the sign-in details from the server. The person then signs in, picks a workspace and chooses **Allow access**.

The server publishes its OAuth details at `/.well-known/oauth-protected-resource/api/mcp`. A sign-in connection has a daily credit limit of 2,000 credits by default.

## Scopes

Each tool needs one scope. A key or connection only sees tools its scopes allow.

| Scope             | What it allows                                                                                                                                                        |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `adspy:read`      | Search Ad Spy ads and brands and read stored research. Live searches use credits.                                                                                     |
| `adspy:write`     | Follow brands, save and share Ad Spy ads, manage Ad Spy boards, saved searches and filter presets, and start video transcripts, video analysis and script generation. |
| `ads:read`        | Read products, sales angles, boards and generated ads, check generation status and get download links.                                                                |
| `ads:write`       | Generate, clone and edit image ads and their copy, generate hero images and remove their backgrounds, and generate sales angles and hooks. Uses credits.              |
| `products:write`  | Create and edit products, offers, notes, research documents, hero images and sales angles. Filling in a product from a web page uses credits.                         |
| `library:write`   | Create, organize and share boards, and delete, restore or permanently remove ads.                                                                                     |
| `workflows:write` | Reserved. No tools use it yet.                                                                                                                                        |

The [MCP tool reference](https://sellify.ai/docs/developers/mcp-tools) lists the scope for every tool.

## Who can change data

Reading is open to any member whose key or connection has the right scope. Changing data needs a workspace owner or admin. A member's connection can read and search even when it has write scopes, and a write call from a member is refused.

Owners and admins can also limit what members do with MCP, or turn it off. See [Control MCP access for your workspace](https://sellify.ai/docs/developers/mcp/manage-access).

## Related

[Quickstart](https://sellify.ai/docs/developers/quickstart) · [Credits and limits](https://sellify.ai/docs/developers/credits-and-limits) · [Control MCP access for your workspace](https://sellify.ai/docs/developers/mcp/manage-access)