> ## Documentation Index > Fetch the complete documentation index at: https://widgetic.com/llms.txt > Use this file to discover all available pages before exploring further. # Authentication > How an AI assistant signs in to Widgetic, which permissions it can hold, and how to revoke its access An assistant can connect to `https://mcp.widgetic.com` in two ways. Both act as your Widgetic account, and both need a plan that includes API access. | | Sign in with Widgetic (OAuth) | API key | | - | - | - | | Best for | ChatGPT, Codex, Cursor, Claude Code, VS Code | Clients that cannot open a browser, scripts | | You do | Approve the connection once on a Widgetic page | Create a key and put it in the client's settings | | Permissions | Exactly the ones you approve | All of them | | Ends when | You remove it, or Widgetic ends it for you | You delete or rotate the key | ## Sign in with Widgetic The assistant starts the sign-in for you. You are taken to a Widgetic page, you sign in if you are not already, and you see which application is asking and what it would be allowed to do: **1. The assistant asks to connect** Your client registers itself with Widgetic automatically and opens your browser. **2. You review the request** The page names the application and lists each permission in plain words. Nothing is granted until you choose **Allow**; **Cancel** refuses the request. **3. The assistant is connected** The client receives a short-lived access token and a way to renew it, and keeps itself signed in. You are not asked again until you remove the connection. > [!WARNING] > > Only approve a request you started. Check that the page is on `widgetic.com` and that the application name is the one you are connecting. ### Permissions These are the permissions an assistant can ask for. The consent page uses exactly these words. | Permission | What you are told you are approving | | - | - | | `widgetic.read` | See your widgets, media library, Brand Kit, A/B tests, translations, workflows and account details | | `widgetic.write` | Create and change widgets, your Brand Kit, A/B tests, translations and workflows, and add, rename and move files in your media library. Creating widgets uses your plan's credits. A translation sends the widget's text to a language model | | `widgetic.publish` | Publish widgets and workflows, take a widget offline again, start A/B tests and turn on translations. A published widget is visible to anyone who has the link, and a test or a translation changes what visitors to your pages see | | `widgetic.delete` | Delete widgets, with their versions and published copies, and files from your media library. This cannot be undone: embeds of a deleted widget stop working on websites, and widgets that load a deleted file stop showing it | | `openid` | Confirm that you are signed in to Widgetic | | `email` | See your email address | | `profile` | See your name | | `offline_access` | Stay connected until you disconnect it, without asking you to sign in again | Each tool needs one of the first four; the [tools reference](https://widgetic.com/docs/agents/tools.md) says which. A tool called without its permission is refused and the assistant is told to ask you to connect again and approve it. A finished build also needs `widgetic.publish` to publish itself: a connection approved without it still builds, and keeps the result as a draft until you connect again and approve publishing, or publish it in Widgetic. ## API keys Create a key under **Settings** > **API Keys** in your [Widgetic dashboard](https://app.widgetic.com), then send it on every request: ```bash theme={null} Authorization: Bearer wgt_usr_your_api_key_here ``` Personal keys (`wgt_usr_`) and organization keys (`wdg_org_`) work, as long as the key was made with full access. You can [limit a key](https://widgetic.com/docs/authentication.md#limit-what-a-key-can-do) to some of what your account may do (Read only, Content or Custom), and the Widgetic MCP server refuses a key limited that way, because it hands an assistant every tool your account has. A key that works carries all four permissions, and there is no way to narrow it, so prefer signing in with Widgetic wherever the client supports it. Keep keys out of shared files and public repositories; see [Authentication](https://widgetic.com/docs/authentication.md) for key handling in general. ## Revoking access **1. Open your connected apps** Go to [widgetic.com/profile/connected-apps](https://widgetic.com/profile/connected-apps) while signed in. **2. Disconnect the application** Choose **Disconnect** next to the assistant and confirm. It stops being able to use your account straight away, and it has to ask you for permission again to get back in. Removing the server inside your assistant only makes the assistant forget it. To end the access itself, disconnect it at Widgetic as above. An API key is revoked by deleting it in the dashboard. ### When Widgetic ends a connection for you Widgetic disconnects every connected assistant when you: * change your password, * delete your account, or * are removed from a team seat and nothing else, such as a plan of your own or a seat in another team, still gives you API access. If your plan ends, connections are not removed but every request is refused until the account has API access again. ## Errors | Status | Meaning | What to do | | - | - | - | | `401 Unauthorized` | No credentials, or they are invalid or expired. The response names where the sign-in details are published (`WWW-Authenticate` with `resource_metadata`) | Sign in again, or check the API key | | `403 forbidden` | Your plan does not include API access (the message says so), the key was made with a limit (the message says the endpoint needs a key made with full access), or the credential may not use the Widgetic MCP endpoint | Change plan, ask your team owner, or make a key with full access | | A tool result that says `Widgetic needs your permission for this` | The connection was approved without a permission this one tool needs. The request itself succeeds (it is not an HTTP error): the result is marked as an error and carries a `WWW-Authenticate` challenge in its `_meta`, with `error="insufficient_scope"` and the missing permission in `scope`. That is how ChatGPT knows to show its connect screen again | Connect again and approve every permission | | `403 access_denied` | Widgetic is not available in this assistant right now | Use another client, or try again later | | `405 Method Not Allowed` | The server answers `POST` only | Send requests with `POST` | | `406 Not Acceptable` | `Accept` does not list both `application/json` and `text/event-stream` | Send both | | `413 Payload Too Large` | The request body is over 1 MiB | Send less | | `429 Too Many Requests` | Too many requests for your account or network address in a short time | Wait for the time in `Retry-After` | | `503 Service Unavailable` | Widgetic could not check the credential just now | Try again after the time in `Retry-After` | ## Privacy Widgetic receives what your assistant sends in tool calls, such as the description of a widget you asked for, and the files you ask it to save. It does not receive the rest of your conversation. Requests to create or revise a widget are screened with a content moderation service first. The [privacy policy](https://widgetic.com/privacy) has the details, and [support](https://widgetic.com/support) can help with any question about a connection. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.