Choose a sign-in method for your client
If the MCP client supports the required OAuth flow, complete browser sign-in and review permissions before connecting. For a compatible tool without that sign-in, create an AURA key in the workspace. Its full value is shown at creation, so store it in protected client settings. Do not publish it in an article, URL, repository or screenshot. The official MCP specification describes authorization of HTTP connections; AURA adds its own project restrictions. Compatibility of a specific interface is verified by an actual successful call rather than the model's name.
Separate reading, observations and changes
Reading projects, questions and reports requires read. Saving an actual AI answer requires observe; working with questions and context requires write_project. Draft preparation, publication and URL submission have separate permissions. Task management is also distinct from website access itself. For example, a contractor can read reports without permission to publish content. Access to the specific project also matters: the relevant scope does not open websites the owner has not selected. An agent must not expand its own privileges to continue a task.
Check the displayed permissions rather than an assumed preset
New connections may show a guided capability set for the full workflow. Previously saved restrictions must not expand automatically at the next sign-in. Review the project and operation list before confirming, then configure autopilot policy separately. For example, creation of a new project can be permitted without opening existing client websites. For a temporary contractor, limited duration and access only to the required project are useful. The secret stays in the tool configuration; permissions and usage history are reviewed in AURA's interface.
What to do after a denial or completion
If reading works but saving an answer is denied, check observe and the active policy. If publication is denied, the relevant permission, a verified domain and an allowed section are required. Do not bypass the error through another account or a copied project. Return via the access-management link, deliberately change the necessary setting and retry. After the collaboration ends, revoke the connection or key. This stops further access through it; already saved content and previously published pages require a separate decision about their future.
Conditions and limitations
- An AURA key does not provide an AI-chat session
- Revoking access does not remove old publications
- Secrets must not appear in public material