Authentication

Two ways to connect.

A connection always acts as a real PLCs.ai identity — your organization, your permissions. Choose OAuth (sign in) or an API key (bearer). Both are first-class.

Cloud OAuth (sign in with your account)

The cloud server is an OAuth 2.1 resource server. When your client connects without a credential, it is bounced to PLCs.ai to sign in:

  1. Your client discovers the authorization server and registers itself automatically (Dynamic Client Registration) — no manual app setup.
  2. A browser opens the consent screen; you sign in with your PLCs.ai account and pick the organization to connect.
  3. The client receives a short-lived access token (refreshed automatically) and starts calling tools — acting as you, with your membership permissions.

Access tokens are short-lived and refreshed automatically, and you can revoke a connection at any time from your PLCs.ai account.

API key (bearer)

Prefer a key for headless / server integrations and on-prem. Mint one in the app under Settings → API Keys (owner/admin), give it the scopes your tools need, and present it as a header:

http
Authorization: Bearer plck_live_8f2a…

The organization is resolved from the key; the key's scopes gate which tools work (see Permissions & scopes). In a client config, that's the headers block:

json
"plcs-ai": {
  "type": "http",
  "url": "https://mcp.plcs.ai/mcp",
  "headers": { "Authorization": "Bearer plck_live_…" }
}

The secret is shown exactly once at creation. Store it safely; if it leaks, revoke and re-mint. Don't commit configs that contain it.

On-prem (appliance)

The on-prem appliance runs the MCP server entirely inside your network, authenticated with your PLCs.ai API key. Point your client at http://APPLIANCE_HOST:8080/mcp with the Authorization header — no data leaves your network.