Authentication
Sign in with OAuth from your client, or send an API key. Both spend one workspace's credits.
Manifold takes two kinds of credential. Both go to https://mcp.manifoldmcp.com/mcp as a bearer token, and both spend the credits of one workspace.
| OAuth | API key | |
|---|---|---|
| For | Chat apps and coding agents that can sign in | Scripts, CI, and clients that cannot run OAuth |
| How | Your client opens a browser and you sign in | Copy a key from the app and send it as a header |
| Spends | Your personal workspace's credits | The credits of the workspace that made the key |
#OAuth
Most clients find the sign-in by themselves. The server publishes its OAuth metadata (RFC 9728) and the client runs OAuth 2.1 with PKCE:
https://mcp.manifoldmcp.com/.well-known/oauth-protected-resource/mcpYou see the Manifold sign-in page. Sign in with Google or email and approve the client. The first sign-in creates your account with 500 free credits.
#API keys
The dashboard at app.manifoldmcp.com has a key ready to copy. Make more keys, and revoke them, on the API keys page. Send a key in the Authorization header:
Authorization: Bearer mk_live_...A key you make on the API keys page is shown once. Manifold keeps only a hash of it, so a lost key cannot be recovered: revoke it and make another. A revoked key can keep working for up to a minute while the change reaches every data centre.
#Workspaces
Credits, keys, usage and billing belong to a workspace, not to a person, so a team shares one balance and one set of keys. Sign-up creates a personal workspace, and the account menu in the app switches between workspaces.
OAuth spends your personal workspace's credits. To spend a team workspace's credits from a client, use an API key made in that workspace.
#Turn tool groups off
The app's Tools page has a switch for each tool group. A group that is off is not in the tool list your clients see, and the change reaches the server within a minute. get_task has no group and is always there, so a task that already started can still be read.
#When a request is refused
A missing or bad credential gets HTTP 401 with a WWW-Authenticate header that points at the OAuth metadata. The error_description says why:
| Description | What to do |
|---|---|
| Bearer token required | Send a token, or sign in from your client |
| API key is unknown or revoked | Copy a current key from the app |
| OAuth token is invalid or expired | Sign in again from your client |