Authentication
Connections authenticate with a key you create in the app and paste into your AI client. There is no browser sign-in step and no OAuth consent screen — the key is the credential.
| Server address | https://upsell.avada.io/mcp |
| Credential | A key beginning aov_mcp_ |
| Sent as | Authorization: Bearer aov_mcp_… |
| Scope | Read only |
| Rate limit | 60 requests per minute, per connection |
| Requires | A paid plan, re-checked on every request |
Create a key
- In AOV.ai Free Gift, go to Settings, then find the Connect to AI section.
- Copy the Server address shown there. You will need it alongside the key.
- Type a Connection name — use the name of the tool you are connecting, for example Claude Desktop. It is only there to tell connections apart. 1–40 characters.
- Click Create key.
The key appears once, with ready-to-paste setup snippets for Claude Code, Cursor and Claude Desktop underneath. Copy the snippet for your tool, then follow Install a client.
The key is displayed only at this moment. The server stores a fingerprint of it, not the key, so it cannot be shown again — not by you, and not by support. Put it in a password manager before you close the banner.
If you try to reuse the name of a connection that is still active, the field shows an error and Create key stays disabled. Names have to be distinct so that revoking the right one later is unambiguous.
Where the key goes
Your client sends it as a bearer token on every call:
Authorization: Bearer aov_mcp_your_key_hereThe word Bearer, a single space, then the key. A missing prefix produces a refusal that reads like
a bad key rather than a bad request, which is a confusing hour to lose. The setup snippets in the app
already include it.
Nothing is ever sent in a URL. The key belongs in the Authorization header only.
Reading the connections list
Each connection shows a name, its badges, and when it was last used.
| Badge | Means |
|---|---|
| Active | The key works |
| Revoked | The key has been turned off and will never work again |
| Connected | The key was used in the last 15 minutes |
| Read only | This connection cannot change anything |
Connected is not a live session. AI clients do not hold a socket open to the server — they call it when they need something and then go quiet. Recent use is the only evidence available, so an assistant sitting idle for twenty minutes stops showing as connected while remaining perfectly usable.
Revoke, and delete
Revoke stops the key working. It takes effect on the very next call, there is no confirmation step, and it cannot be undone. Revoke when a key may have leaked, when you stop using a tool, or when a laptop leaves your control.
Delete appears only on a connection that is already revoked. It removes the row from the list. It does not stop anything — revoking already did that — it just keeps the list readable once you have a few spent keys.
This key does not work anywhere else
Free Gift issues keys for two separate surfaces, and they are deliberately not interchangeable:
| Prefix | Surface | For |
|---|---|---|
aov_mcp_ | /mcp | AI clients |
aov_sk_ | /store-api/v1 | Your own scripts and integrations |
A key minted for one is refused by the other. Paste an aov_mcp_ key into a REST integration and it
is turned down as the wrong surface, rather than quietly becoming a second credential you have to
track. Revoking one surface never disturbs the other.
Keeping the key safe
- Never paste it into a chat, an issue, a commit, or a screenshot.
- Keep it out of shared config files and anything that reaches a repository. Where a client supports it, put it in an environment variable rather than inline — the Claude Desktop snippet does this.
- Use one named key per tool. Shared keys make the connections list meaningless and turn revoking into a choice between breaking everything and breaking nothing.
- Revoke rather than reuse. Creating a replacement takes a few seconds.
Reading an authentication error
Your assistant will read the refusal back to you in plain language. Each one is specific about what to do, and in particular about what not to do.
| Message says | Means | Action |
|---|---|---|
| No key was sent | The client is not passing the header at all | Fix the client config. Do not revoke your key — it is not the problem |
| This connection was revoked | The key was turned off in the app | Create a new key |
| Not included in your current plan | The store is no longer on a paid plan | Upgrade; the same key resumes working |
| The app is no longer installed | The store uninstalled Free Gift | Reinstall. Revoking and re-minting will not help |
| Hit its limit of 60 requests per minute | Too many calls in one minute | Wait about a minute |
Full symptom-by-symptom detail is in Troubleshooting.