Authentication
Sign in with OAuth from your client, or send an API key. Both spend one workspace's credits.
There are two ways to connect to Manifold: sign in from your client with OAuth, or send an API key. Most people should sign in, because the client does the work for you. Use an API key for scripts, CI and clients that cannot sign in. Either way, the credential goes to https://mcp.manifoldmcp.com/mcp as a bearer token and spends the credits of one workspace.
| OAuth | API key | |
|---|---|---|
| Best for | Chat apps and coding agents that can sign in | Scripts, CI, and clients that cannot run OAuth |
| How it works | Your client opens a browser and you sign in | You copy a key from the app and send it as a header |
| Spends | Your active workspace's credits | The credits of the workspace that made the key |
Sign in with OAuth
You usually do not need to set anything up. When you add the server, your client finds the sign-in by itself: the server publishes its OAuth metadata (RFC 9728), and the client runs OAuth 2.1 with PKCE from there.
https://mcp.manifoldmcp.com/.well-known/oauth-protected-resource/mcpYour client opens the Manifold sign-in page. Sign in with Google or email and approve the client. The first time you sign in, Manifold creates your account on the free plan, with 250 credits every month. If you belong to more than one workspace, the same page asks which one the client spends.
Use an API key
The dashboard at app.manifoldmcp.com has a key ready to copy. You can make more keys, and revoke old ones, on the API keys page. Send the key in the Authorization header:
Authorization: Bearer mk_live_...Keep your keys safe. A key you make on the API keys page is shown once, and Manifold keeps only a hash of it, so a lost key cannot be recovered. If you lose one, revoke it and make another. A revoked key can keep working for up to a minute while the change reaches every data centre.
Workspaces
Credits, keys, usage and billing belong to a workspace, not to a person. That way a team shares one balance and one set of keys. When you sign up you get a personal workspace, and the account menu in the app switches between the workspaces you belong to.
Your agent spends your active workspace: the one you chose when you connected, or the one you last switched to in the app, whichever came later. Switch in the app and your connected clients follow, with no need to connect them again. If you leave a workspace or someone removes you, your agent goes back to your personal workspace within five minutes. An API key always spends the workspace that made it, whoever uses it.
Turn tool groups off
If you only need some of the tools, turn the others off on the app's Tools page, which has a switch for each tool group. A group that is off disappears from the tool list your clients see within a minute. A shorter list also helps your agent pick the right tool. get_task has no group and is always there, so a task that has already started can still be read.
When a request is refused
A missing or bad credential gets HTTP 401 with a WWW-Authenticate header that points at the OAuth metadata. The error_description says what went wrong:
| Description | What to do |
|---|---|
| Bearer token required | Send a token, or sign in from your client |
| API key is unknown or revoked | Copy a current key from the app |
| OAuth token is invalid or expired | Sign in again from your client |