Stackyapper supports OAuth for interactive AI clients and bearer API keys for headless clients that cannot complete an interactive sign-in.

New to connected AI? Start with What is MCP, and why would your business need it? before choosing a client.

After connecting, most AI clients list only a small set of stackyapper_ tools — router tools such as stackyapper_search_tools, stackyapper_get_tool_schemas, and stackyapper_execute_read_tool, plus a few workflow and feedback tools. This is the expected surface, not a missing grant: the client uses the router tools to search the full catalog of tools your account is allowed to use and runs them on demand, and Stackyapper checks access again before every request.

ChatGPT is the exception. It receives a curated allowlist of common tools with simplified schemas, plus search and fetch tools, because ChatGPT rejects large tool lists.

Tool names are pinned for the life of a client session. After an administrator changes your app or tool grants, start a new conversation or reconnect the client so it picks up the new catalog.

Ask the client to run a read-only tool against an app you can read, limited to a few records, then confirm the call appears under Audit in the same workspace with your user and the client name. The full verification flow, including what to do when the test fails, is in Connect a client and verify.

OAuth is preferred because the authorization is tied to the signed-in user and workspace. For automation that cannot open a browser, the signed-in user can create and revoke their own bearer API client in the portal. API clients inherit that user's workspace policy.