Authentication

Ontyx has three kinds of credential, each for one job: a connector sign-in for AI assistants, a personal API key for tools that can’t sign in through a browser, and a push key for scripts that send data.

Credential	For	Acts as	Where it comes from
Connector sign-in	An AI assistant with a connector screen (Claude, ChatGPT and others)	You, with your role	Signing in through the connector. Nothing to copy.
Personal API key	An assistant or tool that can reach the server but can’t sign in through a browser	You, with your role	/dashboard/api-keys
Push key	A script sending data through the Push API	Your organization, adding data only	The dashboard’s API keys page (owners and admins)

A personal API key and a connector sign-in reach the same tools: what you see depends on your role, not on how you connected. A push key works only on the push API, and a personal key or a connector sign-in doesn’t work there.

Terms acceptance

Your account must have accepted the current Terms of Service. New accounts accept while signing up; anyone who signed up earlier, and everyone after the terms change, accepts once at /legal/accept. Until then, connector requests are refused with TERMS_ACCEPTANCE_REQUIRED and a link to that page. Accept and try again: you don’t need to reconnect.

Add https://mcp.ontyx.io/mcp as a connector and sign in with your Ontyx account in the browser window that opens. https://mcp.ontyx.io and https://mcp.ontyx.io/mcp reach the same server, so either works. Nothing secret is stored in a config file, and removing the connector in your assistant ends it. See Connect your assistant.

Personal API keys

For an assistant or tool that can’t do the browser sign-in, create a personal key at /dashboard/api-keys (it isn’t in the dashboard’s menu; the address works for any signed-in account). Give it a name, such as the tool that will use it, and copy it straight away: it’s shown only once. Tick the read:data scope if the key should also reach the market context tools; the tools for your own data don’t need it.

Send it as a bearer token to the server address:

Authorization: Bearer ontyx_live_ak_<keyId>_<secret>

For example, Claude Desktop can use a key through the mcp-remote bridge. In claude_desktop_config.json (on macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "ontyx": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.ontyx.io/mcp", "--header", "Authorization:Bearer ${ONTYX_API_KEY}"],
      "env": { "ONTYX_API_KEY": "ontyx_live_ak_<keyId>_<secret>" }
    }
  }
}

Restart Claude Desktop, and the Ontyx tools appear. Other clients follow the same pattern: the server address, with an Authorization header.

A personal key acts as you: it sees your organization’s data with your role, and stops working for your organization’s data if you’re removed from it. Revoke a key at /dashboard/api-keys; it’s refused from its next request.

Push keys

An owner or admin creates push keys on the dashboard’s API keys page, one per script. A push key can only add data to the organization’s datasets: it can’t read anything and can’t connect an assistant. Each load it sends is recorded as pushed by that key, by its name. Revoking it stops it straight away. See the Push API.

Key format

Personal keys and push keys share one format:

ontyx_<env>_ak_<keyId>_<secret>

ontyx marks it as an Ontyx key, so it’s easy to spot in logs and secret scanners.
env is live.
keyId is a 26-character public identifier. It’s safe to share when you report a problem: it lets Ontyx find the key without you sending the secret.
secret is a 32-character random part. Keep it private.

Ontyx stores only a one-way hash of the secret, never the key itself, so a lost key can’t be recovered. Revoke it and create a new one.

The account API

The dashboard talks to its own account API (members, invitations, push keys, terms) with the signed-in person’s session. It isn’t meant for scripts, and neither kind of API key works there. Its endpoints are listed in the Account API reference.

Market context tools Account API reference