Authentication
Connections authenticate with a key you create in the app and paste into your AI client. There is no browser sign-in step — the key is the credential.
| Server address | https://aov-cart-drawer.firebaseapp.com/mcp |
| Credential | A key beginning aov_mcp_ |
| Sent as | Authorization: Bearer aov_mcp_… |
| Scope | Read only |
| Rate limit | 60 requests per minute, per connection |
| Requires | A paid subscription, re-checked on every request |
Copy the Server address from the app rather than typing the one above. It is shown in Settings → Connect to AI, and it is the address that is correct for your store.
Create a key
- In AOV.ai Cart Drawer, go to Settings, then the Connect to AI tab.
- Copy the Server address.
- Type a Connection name — the tool you are connecting, for example Claude Desktop. It is only there to tell connections apart. 1–40 characters.
- Click Create key.
The key appears once, with ready-to-paste snippets for Claude Code, Cursor and Claude Desktop underneath. Copy the snippet for your tool, then follow Install a client.
The key is displayed only at this moment. The server stores a fingerprint of it, not the key, so it cannot be shown again — not by you, and not by support. Put it in a password manager before you close the banner.
Where the key goes
Your client sends it as a bearer token on every call:
Authorization: Bearer aov_mcp_your_key_hereThe word Bearer, a single space, then the key. The generated snippets already include it. Nothing
is ever sent in a URL — the key belongs in the Authorization header only.
The connections list
Each connection shows its name, its badges, and when it was last used.
| Badge | Means |
|---|---|
| Active | The key works |
| Revoked | The key has been turned off and will never work again |
| Read only | This connection cannot change anything |
Revoke stops the key working from the very next call. There is no confirmation step and it cannot be undone. Revoke when a key may have leaked, when you stop using a tool, or when a laptop leaves your control.
This key does not work anywhere else
Cart Drawer issues keys for two separate surfaces, and they are deliberately not interchangeable:
| Prefix | Surface | For |
|---|---|---|
aov_mcp_ | /mcp | AI clients |
aov_sk_ | /store-api/v1 | Your own scripts — see Store API |
A key minted for one is refused by the other, and revoking one surface never disturbs the other.
Keeping the key safe
- Never paste it into a chat, an issue, a commit, or a screenshot.
- Keep it out of shared config files and anything that reaches a repository. Where a client supports it, put it in an environment variable — the Claude Desktop snippet does this.
- Use one named key per tool. A shared key makes the connections list meaningless and turns revoking into a choice between breaking everything and breaking nothing.
- Revoke rather than reuse. Creating a replacement takes seconds.
Reading an authentication error
Your assistant reads the refusal back to you in plain language.
| Message says | Means | Action |
|---|---|---|
| This connection was revoked | The key was not accepted | See the note below before you act |
| Isn't included in this store's current subscription | The subscription lapsed | Renew; the same key resumes working |
| Hit its limit of 60 requests per minute | Too many calls in one minute | Wait about a minute |
"This connection was revoked" is also what you get when the client sends no key at all. The
message tells you to create a new key, and in that case creating one will not help — the new key will
not be sent either. Before minting a replacement, check that your client is actually passing the
Authorization header. See Troubleshooting.