---
title: X
description: Creating an API key just to plug WatchFor into an AI client is a chore, and pasting keys around is how they leak. WatchFor now runs a full OAuth 2.1…
canonical: https://watchfor.io/changelog/2026-08-26-oauth-mcp
---

[All updates](/changelog/page/6#2026-08-26-oauth-mcp) ✨ New Aug 26, 2026 · v 5.9.1

# OAuth sign-in for MCP clients — connect AI agents without an API key

Creating an API key just to plug WatchFor into an AI client is a chore, and pasting keys around is how they leak. WatchFor now runs a full OAuth 2.1 authorization server: MCP clients that support it (Claude connectors, Claude Code and others) connect by approving access on a consent screen in your browser, no API key needed. You choose read-only or read+write access, and every authorization can be revoked instantly.

## How connecting works now

- Add https://watchfor.io/api/mcp to your AI client. In Claude, that's Settings → Connectors → Add custom connector .

- Your browser opens a WatchFor consent screen. Sign in if needed.

- Choose what the client may do: read only, or read and write.

- Approve. The client is connected, and no key was ever copied or pasted.

## Why it's safer

- The client gets a short-lived access token, which it renews by itself. There's no long-lived secret sitting in a config file.

- The access you granted is the limit. A read-only connection can't create or change anything.

- Changes made through the connection appear in the Activity log as "Name (via OAuth)".

- You can revoke the access at any time, and the client is cut off at once.

## An example

You want Claude to help investigate incidents. Before, you created an API key, picked a scope and pasted it into a config file. Now you add the connector, approve read-only access on the consent screen, and ask "what broke overnight?" a minute later.

API keys still work for scripts and clients that don't support OAuth. Details in [Authentication](/docs/api/authentication#oauth-21).

Since then: the consent screen names the app and flags unknown ones, and Connected apps lists everything you've approved ([details](/changelog/2026-09-16-oauth-consent-connected-apps)).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-08-26-oauth-mcp · Site guide: https://watchfor.io/llms.txt