AppControler
Start scan

AppControler MCP API keys & endpoints

Works with Any MCP clientAuth via MCP API key~4 min

Create and revoke an MCP API key

  • Create: AppControler → Integrations → MCP / API keys → Create MCP key. The raw acp_… key is shown once — copy it immediately.
  • Revoke: the same page lists active keys with their prefix, scopes, and last-used time. Click Revoke to disable a key instantly.
  • Storage: only a SHA-256 hash plus a 12-character prefix are stored server-side. Lost keys cannot be recovered.

Auth header

Every MCP or REST call uses a Bearer header:

Authorization: Bearer acp_YOUR_KEY

MCP server URL: https://appcontroler.com/api/mcp

Available MCP tools

ToolScopeDescription
list_ai_appsreadList apps; filter by risk, policy, or AI-only
get_app_usersreadWho authorized an app with company sign-in
get_policy_summaryreadPolicy mode + approve / review / block counts
list_upcoming_act_bysreadRenewals and act-by windows
set_app_policywriteSet an app to Approved / Review / Blocked
get_sync_statusreadLatest workspace discovery sync

Quick setups for other MCP clients

Any client that supports HTTP MCP with custom headers works with your API key.

Claude Code (CLI)

claude mcp add --transport http appcontroler https://appcontroler.com/api/mcp --header "Authorization: Bearer acp_YOUR_KEY"

{
  "mcpServers": {
    "appcontrol": {
      "url": "https://appcontroler.com/api/mcp",
      "headers": { "Authorization": "Bearer acp_YOUR_KEY" }
    }
  }
}

The same shape works in Windsurf (~/.codeium/windsurf/mcp_config.json) and VS Code MCP extensions (.vscode/mcp.json).

Smoke test with curl

curl -s https://appcontroler.com/api/mcp \
  -H "Authorization: Bearer acp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

FAQ

OAuth or API key — which one should I use?

Use OAuth (no keys) for Claude and ChatGPT custom connectors — they handle sign-in themselves. Use an MCP API key anywhere you can set an HTTP header yourself: Cursor, Claude Code, Windsurf, VS Code MCP extensions, n8n, Zapier, curl.

What happens if I lose the raw key?

It cannot be recovered — only a hash is stored. Revoke the key in Integrations and create a new one, then update the client that used it.

Are keys scoped to an organization?

Yes. Every key belongs to one organization and only sees that workspace’s apps, users, policies, and renewals.

Do OAuth tokens and API keys expire?

API keys stay valid until you revoke them. OAuth sign-ins (Claude/ChatGPT) issue short-lived access tokens refreshed automatically, and revoking the connector stops them from working.

See every AI tool connected to your workspace

Free scan shows the apps employees authorized with company sign-in — before you connect them to AI assistants.

Start free AI scan

More setup guides