Skip to main content
The NeetoAuth MCP server accepts two credentials. They are not interchangeable: one acts as a person, the other acts as the workspace.
An API key is not tied to a person, so the assistant is not limited by anyone’s permissions. It can invite and deactivate members regardless of who is talking to it. Prefer OAuth unless you specifically need workspace-wide access.

​
OAuth, scoped to you

An OAuth token resolves to a NeetoAuth user, so every tool call is checked against that person’s permissions. A member who cannot invite people in the NeetoAuth UI cannot invite them through the assistant either, and listings are filtered to what they are allowed to see.

​
Sign in

  1. Add the server URL to your assistant. See Connect.
  2. The assistant opens NeetoAuth in your browser.
  3. Enter the workspace you want to connect, on the Connect your workspace screen.
  4. Sign in and approve the request.
The assistant stores the token and refreshes it on its own. You do not paste anything.

​
What the server supports

Clients discover all of this automatically from https://connect.neetoauth.com/.well-known/oauth-authorization-server, so there is nothing to configure by hand. Because registration is dynamic and accepts loopback redirect URIs, terminal clients such as Claude Code, Codex, and the Gemini CLI can complete the flow the same way a browser client does.

​
Connecting more than one workspace

The consent screen asks which workspace to connect, so a token is granted for one workspace at a time. To reach a second workspace, add the server again under a different name and approve it for that workspace.

​
API key, scoped to the workspace

An API key carries no user identity. The permission checks that apply to an OAuth session are skipped entirely, so the assistant can read and change anything in the workspace. Use it when the assistant is acting as a service rather than as a person - a scheduled offboarding job, or a shared internal bot - and when you accept that it is not bounded by any individual’s permissions.

​
Get a key

Create one in your NeetoAuth workspace, then pass it as a bearer token:
See API authentication for where keys live and how to rotate them.
Treat the key like a password. Anything holding it can invite or deactivate members. Do not commit it - .vscode/mcp.json in particular lives in your repository. Prefer an environment variable where your client supports one.

​
How it compares to the API and CLI