Authentication

How agents sign in to the Sigment MCP server, and how you approve and revoke them.

Every request to https://api.sigment.ai/mcp needs Authorization: Bearer <token>. Two kinds of token are accepted:

Token	Prefix	How you get it	Approval
OAuth access token	`oat_`	The client (Claude, ChatGPT, Cursor, Claude Code) signs you in through the browser	You approve the agent in Settings → AI agents
API key	`ak_`	Settings → AI agents → API keys	Approved automatically

Session tokens from the Sigment web app are not accepted at /mcp. Organization-owned keys aren't accepted either: a key must belong to a user.

OAuth discovery

Sigment follows the MCP authorization spec, so clients configure themselves. A request without a token gets 401 with a WWW-Authenticate header pointing at the protected resource metadata:

curl https://api.sigment.ai/.well-known/oauth-protected-resource/mcp

{
  "resource": "https://api.sigment.ai/mcp",
  "authorization_servers": ["https://clerk.sigment.ai"],
  "bearer_methods_supported": ["header"]
}

The authorization server supports dynamic client registration, so there's no client ID to configure.

The first call from a new OAuth client registers it in Sigment → Settings → AI agents, but its tool calls are refused until you approve it. You can revoke an agent or an API key on the same page at any time. A revoked agent gets a message telling the user to re-approve it, and only the account owner can do that.

Workspaces

Tools act on your workspaces. Every tool takes an optional workspace_id; without it, the tool uses your first workspace. get_account lists them.

Why not the REST API?

The REST API is reserved for the Sigment app. It answers 403 "OAuth access tokens and API keys are accepted only at the /mcp endpoint" to agent credentials. The MCP tools are bounded, rate-limited and budget-capped, which is what makes it safe to hand them to an agent.

OAuth discovery

Approving and revoking agents

Workspaces

Why not the REST API?

On this page