Agents and API keys

An assistant that signs in with Allow needs none of this page: see Connect your assistant. This page is for an agent or a client that works with a key.

Agents: one message to paste#

Claude Duet, Grok Bot, Dots and Muse get one message to paste, not a form. Pick your agent at Connect your agent or under Connect assistant in the app, copy the message and paste it in a chat with your agent.

The message holds no key. It points to the docs (https://mysdr.app/llms.txt) and to your Leads and Companies tables (https://mysdr.app/api/v1/tables/leads and /companies), and tells the agent to ask you for one. When it asks, click Create key and copy the gtk_ key. Enter it where the agent asks: in its field for secrets if it has one, so the key stays out of the chat history. The agent then makes one free call to check it (GET https://mysdr.app/api/v1/usage). That first call connects it, and the app shows it.

The agent works with the REST API: it reads and fills your Leads and Companies tables with the same key, so what it finds and keeps is what you see in mySDR. It can run LinkedIn sequences from your own LinkedIn account with the same key, once you connected LinkedIn yourself under LinkedIn in the menu: the agent cannot do that for you. The key needs API access on your plan. mySDR has not verified a Duet-specific dialog (or one for Dots or Muse), and the message needs none: you paste it in a chat.

The REST API#

Every request goes to https://mysdr.app/api/v1 with your key as a Bearer token. Create the key under API keys in the menu; it starts with gtk_ and is shown once. Examples read it from MYSDR_API_KEY.

curl "https://mysdr.app/api/v1/usage" \
  -H "Authorization: Bearer $MYSDR_API_KEY"

What a key can call:

• Every key: Search People (also the people at your companies, with companies), Enrich People (also a work email from a name), Find Phone, Reverse Email Lookup, Search Companies (by name, by industry, size, place and recent activity, or like a company with similar_to), Enrich Companies, the technology data (a tech stack, companies using a technology), the Leads and Companies tables, your process (state, activity, agenda, exclusions), LinkedIn outreach and usage.
• Signals, for every organization: signal searches, monitors and webhooks. They spend credits. A balance that is too low answers 402 insufficient_credits.

For n8n, Make, Zapier or a cron job, including how to pick up new leads, replies and LinkedIn steps on a schedule: n8n and automations.

A missing, invalid or revoked key is 401 on every call, including while an API is closed. A valid key on Signals or the Company API while that API is turned off answers 403 api_not_enabled, with what the key can do instead. Base URL, errors and rate limits are in the API reference.

The two MCP servers#

The same tools over MCP. Both are stateless streamable HTTP and take POST only: GET, PUT, PATCH and DELETE return 405 with Allow: POST, before the key is checked and while an API is closed. Both require Authorization: Bearer on every POST: an access token from signing in with OAuth (paste the URL in your assistant and click Allow), or a key. POST without a key is 401, with resource_metadata pointing to the sign-in.

• Assistant server — POST https://mysdr.app/api/mcp. Allow, or a key that starts with ejk_. The JSON response holds the tools of all three blocks: enrichment, the signal tools, the tables, your process and LinkedIn. It allows 60 calls per minute per key, and a body larger than 512 KB is rejected.
• Signals server — POST https://mysdr.app/api/v1/mcp. The same gtk_ key as the REST API, for a client that works with a key: companies, signals, people at companies, enrich and monitors. Every organization can call it. The response is a server-sent event stream, and its searches use credits. A valid gtk_ key while Signals is turned off answers 403 api_not_enabled. It allows 60 requests per minute per key and 3 concurrent calls that can spend credits. The tools are listed on MCP.

An assistant that signs in with Allow needs only the assistant server.

Keys for MCP#

• Assistant server: key prefix ejk_, from API keys in the menu, then Other → Create assistant key in the app. The full key is shown once. An organization can have 10 active MCP keys; connections made with Allow do not count.
• Signals server: key prefix gtk_, from API keys in the menu.

An ejk_ key cannot call the REST API, and a gtk_ key cannot call the assistant server. Do not put a key in the query string. Give it only to the client or agent that uses it, never in a shared chat or in code.

Generic MCP config#

Paste this when a client asks for a remote MCP server and a header. Replace the key. A client with neither a header field nor OAuth cannot connect.

Assistant server (all three blocks):

{
  "mcpServers": {
    "mysdr-assistant": {
      "url": "https://mysdr.app/api/mcp",
      "headers": {
        "Authorization": "Bearer ejk_…"
      }
    }
  }
}

Signals server (company → signal → lead):

{
  "mcpServers": {
    "mysdr-signals": {
      "url": "https://mysdr.app/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer gtk_…"
      }
    }
  }
}

Grok Bot over MCP#

Grok Bot works with the REST API above. To give it the MCP tools as well, open Settings → Plugins in the Grok Bot app and add a custom MCP server (the app also accepts "Add this MCP server" in chat, then still needs the header below).

• Name: mySDR
• URL: https://mysdr.app/api/mcp for your workspace and LinkedIn, or https://mysdr.app/api/v1/mcp for signal searches
• HTTP header name: Authorization
• HTTP header value: Bearer and the key (ejk_ on the assistant URL, gtk_ on the Signals URL)
• Leave the OAuth client id and secret empty

Save, install the server from Plugins, and attach it in a chat with @. A URL with no header is rejected.

A key in a client that also signs in#

Claude Code, Claude, Cursor and Codex take a key when you prefer one. The header is Authorization: Bearer.

Claude Code#

claude mcp add --transport http --scope user mysdr-signals https://mysdr.app/api/v1/mcp \
  --header "Authorization: Bearer $MYSDR_API_KEY"

Give each server its own name: mysdr for the assistant server and mysdr-signals for the Signals server. Claude Code refuses a second server with a name it already has, and a config file holds each name once. A project .mcp.json needs "type": "http", the URL, and the same header. An entry with a url and no type is skipped. With the header set, Claude Code does not start a sign-in.

Claude Desktop and Claude.ai#

In the custom connector, choose No sign-in and set request header authorization to Bearer plus the key. Request headers are in beta and missing on some organizations; signing in with Allow works everywhere.

Cursor#

~/.cursor/mcp.json, then restart Cursor. Do not add an auth block: mySDR registers Cursor itself when it signs in.

{
  "mcpServers": {
    "mysdr-signals": {
      "url": "https://mysdr.app/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${env:MYSDR_API_KEY}"
      }
    }
  }
}

Codex#

In ~/.codex/config.toml. Codex adds the word Bearer itself.

[mcp_servers.mysdr-signals]
url = "https://mysdr.app/api/v1/mcp"
bearer_token_env_var = "MYSDR_API_KEY"