Use KeptQR from an AI assistant

Connect an assistant

Claude (claude.ai, the desktop and mobile apps)

In Claude, open Customize → Connectors, choose Add custom connector, enter the server URL and choose Add. Then choose Connect on the new connector: Claude opens KeptQR’s sign-in; choose the workspace and the access, then Connect. Custom connectors are available on Claude’s paid plans, and one on Free. On Team and Enterprise an Owner adds the connector in Organization settings → Connectors, then each person connects.

ChatGPT

Coming soon. KeptQR is checking ChatGPT’s sign-in; until then, use Claude, Claude Code or Cursor.

Claude Code

Add the server, then sign in from Claude Code:

claude mcp add --transport http keptqr https://mcp.keptqr.com/mcp

Then run /mcp in Claude Code, choose keptqr and Authenticate (or claude mcp login keptqr from the shell). Your browser opens KeptQR’s sign-in. The consent page says the app runs on your computer (localhost): that is expected for Claude Code.

With an API key instead

Create an API key in the dashboard, under Settings → API (see API keys). Keep it in an environment variable, set in the shell you start the assistant from:

read -rs KEPTQR_API_KEY   # paste the key, then press Enter
export KEPTQR_API_KEY

Add the server to a project’s .mcp.json. The file holds only the variable’s name; Claude Code reads the key from the environment when it connects:

{
  "mcpServers": {
    "keptqr": {
      "type": "http",
      "url": "https://mcp.keptqr.com/mcp",
      "headers": { "Authorization": "Bearer ${KEPTQR_API_KEY}" }
    }
  }
}

Or add it from the shell. The shell puts the key itself into the command, so Claude Code saves the key in its own configuration file:

claude mcp add --transport http keptqr https://mcp.keptqr.com/mcp \
  --header "Authorization: Bearer $KEPTQR_API_KEY"

Cursor (with an API key)

Connect Cursor with an API key for now; steps to sign in from Cursor come later. Set KEPTQR_API_KEY as for Claude Code above, then add the server to mcp.json (.cursor/mcp.json in a project, or ~/.cursor/mcp.json for every project). Cursor reads the key from the environment:

{
  "mcpServers": {
    "keptqr": {
      "url": "https://mcp.keptqr.com/mcp",
      "headers": { "Authorization": "Bearer ${env:KEPTQR_API_KEY}" }
    }
  }
}

Other assistants

Any MCP client that supports OAuth (with a client ID metadata document, or dynamic registration) or a bearer header can connect the same way.

What you approve

When you connect, KeptQR shows the app’s name, whether KeptQR has verified who made it, and where you’ll go back to. Check them before you connect.

• Choose one workspace. Owners and Editors can connect apps; Viewers can’t. A workspace whose plan doesn’t include the API can’t be chosen.
• Choose Read only or Read and write. A read-only connection lists only the read tools.
• Every Owner of the workspace gets an email when an app is connected, and the connection is recorded as an API key named after the app and you (for example, “Claude · Jane”), so changes it makes show in each code’s destination history.

Access and safety

What a connected app can’t do: billing, members, API keys, workspace settings and changes to brand kits are out of reach, whatever access you give. It acts only in the workspace you chose.

• Use Read only, or a read-only key, unless you want the assistant to change codes.
• With a key, try a test key first (kq_test_…; a connection made by sign-in is always live). Reads are real; writes run every check and then save nothing (see test keys).
• Never paste a key into a chat. Give it to the client through its configuration, as above. If a key leaks, revoke it in Settings → API.
• Changing where a code points, deleting a code and deleting a folder are marked destructive, and most assistants ask before running them. The first two change what printed copies of a code do; a deleted folder’s codes keep redirecting.
• Code names, destinations and folder names are your data. An assistant reads them as data; if one ever contains an instruction, the assistant shouldn’t follow it, and destructive tools ask first in most assistants.

Disconnecting

In KeptQR: your own connections are in Account → Connected apps; an Owner sees every connection in the workspace in Settings → API → Connected apps. Disconnect ends it at once.

In the app: removing KeptQR from the assistant stops it using the connection, but doesn’t end it on KeptQR’s side yet. Disconnect it in KeptQR as well.

A connection also ends when you leave the workspace or become a Viewer, and after a year. If the app hasn’t used it for 30 days, it asks you to sign in again, and the new sign-in replaces the old connection.

Tools

A read-only connection or key sees 9 tools; read and write sees all 17. Each makes one call to the matching API operation, so the API reference describes what it accepts and returns.

Limits and errors

Tool calls share the workspace’s rate limits and monthly quota with every other use of the API. A tool call is one request; listing tools, and the messages a client sends to connect, never count toward the quota.

A refused call comes back to the assistant as a tool error with the API’s error code, its message and the request id. Quote the request id if you contact support.

If a connection has ended or a key is invalid, revoked or expired, the connection itself fails (HTTP 401). An app that signed in with KeptQR then asks you to sign in again; with a key, the client reports a connection problem.

Privacy

If you connect an app such as Claude or ChatGPT, we record which app, who connected it, to which workspace and with what access, and keep that with the workspace’s API key history. We store only fingerprints of its sign-in tokens, never the tokens. Its requests are logged like any API request. See the privacy policy.