Skip to main content
The NeetoKB MCP server accepts two credentials, and the choice is a permissions boundary rather than a setup preference. Pick the one that matches how much of the knowledge base the assistant should reach.

​
OAuth, scoped to you

An OAuth grant resolves to your NeetoKB user account, so every request runs under your permissions. Articles in categories you cannot see stay hidden, and an action you are not allowed to take is refused - the assistant sees exactly what you would see in the app. The server publishes its metadata at https://connect.neetokb.com/.well-known/oauth-authorization-server: Clients register themselves, so there is no key to copy. You add the server URL, the assistant sends you to NeetoKB to approve it, and it refreshes the grant on its own from then on.
OAuth currently works with the assistants that sign in through a browser - Claude and ChatGPT. Assistants that complete sign-in on a local callback address are not able to register with this deployment yet, so they connect with an API key. See Connect for which is which.
To sign out, revoke the grant from your NeetoKB workspace or remove the server from the assistant.

​
API key, scoped to the workspace

An API key carries no user identity. Requests made with it are not filtered by anyone’s permissions, so the assistant can reach every article, category, and team member in the workspace, including drafts and private categories. Use it when you want a workspace-wide integration, or when your assistant cannot use OAuth. It is the same key the REST API uses. Learn how to generate one. Your assistant sends it on every request:
Set it once in the assistant’s MCP configuration. Connect shows the right file and format for each one. Replace YOUR_API_KEY with your key, and the assistant sends the header for you.
Treat your API key like a password. Create a separate key for each workspace; a key only works in the workspace where you created it.
An API key gives access to the entire workspace, including unpublished drafts and team member records. Anyone who can read your assistant’s configuration can use it. Do not commit it to a shared repository or paste it where others can see it.

​
How each NeetoKB surface authenticates

​
When authentication fails

MCP does not expose a 401 error the way a direct API request does. A missing or invalid credential usually looks like one of these:
  • The neetokb tools never appear in your assistant.
  • A tool call fails, and the assistant reports it couldn’t reach NeetoKB.
For an API key, that normally means the Authorization header is wrong: the key may be mistyped, belong to another workspace, or have been revoked. Verify or regenerate it in the API Keys article. For OAuth, the grant may have been revoked or the approval never completed - remove the server and add it again. Then follow Troubleshooting.