Authentication

How an AI assistant signs in to Widgetic, which permissions it can hold, and how to revoke its access

An assistant can connect to https://mcp.widgetic.com in two ways. Both act as your Widgetic account, and both need a plan that includes API access.

	Sign in with Widgetic (OAuth)	API key
Best for	ChatGPT, Codex, Cursor, Claude Code, VS Code	Clients that cannot open a browser, scripts
You do	Approve the connection once on a Widgetic page	Create a key and put it in the client’s settings
Permissions	Exactly the ones you approve	All of them
Ends when	You remove it, or Widgetic ends it for you	You delete or rotate the key

​

Sign in with Widgetic

The assistant starts the sign-in for you. You are taken to a Widgetic page, you sign in if you are not already, and you see which application is asking and what it would be allowed to do:

1. The assistant asks to connect

   Your client registers itself with Widgetic automatically and opens your browser.

2. You review the request

   The page names the application and lists each permission in plain words. Nothing is granted until you choose Allow; Cancel refuses the request.

3. The assistant is connected

   The client receives a short-lived access token and a way to renew it, and keeps itself signed in. You are not asked again until you remove the connection.

Only approve a request you started. Check that the page is on widgetic.com and that the application name is the one you are connecting.

​

Permissions

These are the permissions an assistant can ask for. The consent page uses exactly these words.

Permission	What you are told you are approving
widgetic.read	See your widgets, media library, Brand Kit, A/B tests, translations, workflows and account details
widgetic.write	Create and change widgets, your Brand Kit, A/B tests, translations and workflows, and add, rename and move files in your media library. Creating widgets uses your plan’s credits. A translation sends the widget’s text to a language model
widgetic.publish	Publish widgets and workflows, take a widget offline again, start A/B tests and turn on translations. A published widget is visible to anyone who has the link, and a test or a translation changes what visitors to your pages see
widgetic.delete	Delete widgets, with their versions and published copies, and files from your media library. This cannot be undone: embeds of a deleted widget stop working on websites, and widgets that load a deleted file stop showing it
openid	Confirm that you are signed in to Widgetic
email	See your email address
profile	See your name
offline_access	Stay connected until you disconnect it, without asking you to sign in again

Each tool needs one of the first four; the tools reference says which. A tool called without its permission is refused and the assistant is told to ask you to connect again and approve it. A finished build also needs widgetic.publish to publish itself: a connection approved without it still builds, and keeps the result as a draft until you connect again and approve publishing, or publish it in Widgetic.

​

API keys

Create a key under Settings > API Keys in your Widgetic dashboard, then send it on every request:

Authorization: Bearer wgt_usr_your_api_key_here

Personal keys (wgt_usr_) and organization keys (wdg_org_) work, as long as the key was made with full access. You can limit a key to some of what your account may do (Read only, Content or Custom), and the Widgetic MCP server refuses a key limited that way, because it hands an assistant every tool your account has. A key that works carries all four permissions, and there is no way to narrow it, so prefer signing in with Widgetic wherever the client supports it. Keep keys out of shared files and public repositories; see Authentication for key handling in general.

​

Revoking access

1. Open your connected apps

   Go to widgetic.com/profile/connected-apps while signed in.

2. Disconnect the application

   Choose Disconnect next to the assistant and confirm. It stops being able to use your account straight away, and it has to ask you for permission again to get back in.

Removing the server inside your assistant only makes the assistant forget it. To end the access itself, disconnect it at Widgetic as above. An API key is revoked by deleting it in the dashboard.

​

When Widgetic ends a connection for you

Widgetic disconnects every connected assistant when you:

• change your password,
• delete your account, or
• are removed from a team seat and nothing else, such as a plan of your own or a seat in another team, still gives you API access.

If your plan ends, connections are not removed but every request is refused until the account has API access again.

​

Errors

Status	Meaning	What to do
401 Unauthorized	No credentials, or they are invalid or expired. The response names where the sign-in details are published (WWW-Authenticate with resource_metadata)	Sign in again, or check the API key
403 forbidden	Your plan does not include API access (the message says so), the key was made with a limit (the message says the endpoint needs a key made with full access), or the credential may not use the Widgetic MCP endpoint	Change plan, ask your team owner, or make a key with full access
A tool result that says Widgetic needs your permission for this	The connection was approved without a permission this one tool needs. The request itself succeeds (it is not an HTTP error): the result is marked as an error and carries a WWW-Authenticate challenge in its _meta, with error="insufficient_scope" and the missing permission in scope. That is how ChatGPT knows to show its connect screen again	Connect again and approve every permission
403 access_denied	Widgetic is not available in this assistant right now	Use another client, or try again later
405 Method Not Allowed	The server answers POST only	Send requests with POST
406 Not Acceptable	Accept does not list both application/json and text/event-stream	Send both
413 Payload Too Large	The request body is over 1 MiB	Send less
429 Too Many Requests	Too many requests for your account or network address in a short time	Wait for the time in Retry-After
503 Service Unavailable	Widgetic could not check the credential just now	Try again after the time in Retry-After

​

Privacy

Widgetic receives what your assistant sends in tool calls, such as the description of a widget you asked for, and the files you ask it to save. It does not receive the rest of your conversation. Requests to create or revise a widget are screened with a content moderation service first. The privacy policy has the details, and support can help with any question about a connection.