Authentication and access

DropTrack sign-in through OAuth

The MCP connection uses OAuth with DropTrack sign-in. Supported clients handle authorization, access tokens, and refresh. You do not need a personal API key.

Public authorization metadata is available at:

https://mcp.droptrack.com/.well-known/oauth-authorization-server

The advertised grants are authorization code and refresh token, with S256 PKCE. A machine-to-machine client-credentials grant is not currently advertised.

Account permissions

Tools operate in the authorized user's company context. A connected assistant does not gain permission to another company's data. If you need a different company, use the supported account/client flow and reconnect as needed.

Some operations depend on account role or plan. Before a write, confirm the intended environment and company, review the action, and follow any confirmation required by the tool. Admin-only operations are outside this developer site's scope.

Credentials and browser endpoints

The website's application endpoints and browser sessions are not the supported developer REST contract. Do not copy browser cookies into an integration or assume MCP tokens authenticate arbitrary website endpoints.

The supported connection is MCP with DropTrack sign-in. Self-service API keys are not offered.