Connect your AI

Talk to your AI and let it run Orishare for you: read your programs, draft rules and campaigns, check customers and events. There are two ways to connect, and every client below supports at least one of them.

Both reach the same tools as the hosted MCP server described on Connect MCP.

One-click sign-in

1. Add the connector URL https://api.orishare.com/mcp/connect to your AI app (steps per client below).
2. The app opens Orishare in your browser. Sign in as usual.
3. On the consent screen, choose what the app may reach:
   • Organization: one of the organizations you belong to.
   • Environments: sandbox only, sandbox and production, or choose environments yourself.
   • Access: read only, or full access (everything your role allows).
   • Expiry: how long the connection lasts.
4. Approve. You are back in your AI app, connected.

The consent screen shows the app's name, logo and website as the app describes itself, marked unverified, and where Orishare will send you back. Approve only apps you added yourself.

Disconnect at any time in Settings → AI connections → Connected apps. Disconnecting revokes the connection and every token it holds at once.

AI access key

An AI access key is a long-lived key for an AI client. Create one in Settings → AI connections:

• Name: so you recognize it later (for example "Cursor on my laptop").
• Access level: read only, full access, or custom scopes.
• Environments and a default environment: the environments the key may use and the one it acts in when the client names none.
• Expiry: 30 days, 90 days, 1 year or never.

The key (opat_...) is shown once. Copy it into your AI client and keep it out of version control. Use it with the MCP URL https://api.orishare.com/mcp as the header Authorization: Bearer opat_.... With a default environment set, the client needs no X-Orishare-Environment header. Revoke the key in the same settings page.

Claude.ai and Claude Desktop

Sign-in. In Claude, open Settings (or Customize) → Connectors → Add custom connector, name it Orishare and enter the URL:

https://api.orishare.com/mcp/connect

Claude opens the Orishare consent screen; approve, and the connector is ready in Claude.ai and in Claude Desktop.

Access key (Claude Desktop). Add Orishare to claude_desktop_config.json (Claude Desktop: Settings → Developer → Edit Config) through mcp-remote, which needs Node.js:

{
  "mcpServers": {
    "orishare": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.orishare.com/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer opat_..."
      }
    }
  }
}

The header value sits in env because some systems split arguments on spaces. Restart Claude Desktop after saving.

Claude Code

Sign-in.

claude mcp add --transport http orishare https://api.orishare.com/mcp/connect

Then run /mcp inside Claude Code, pick orishare and sign in.

Access key.

claude mcp add --transport http orishare https://api.orishare.com/mcp \
  --header "Authorization: Bearer opat_..."

ChatGPT

In ChatGPT, turn on developer mode for apps, then create a connector (in Settings → Apps):

• URL: https://api.orishare.com/mcp/connect
• Authentication: OAuth

ChatGPT opens the Orishare consent screen when you connect. ChatGPT does not accept an access key for custom connectors, so use sign-in.

Cursor

One-click install. Add Orishare to Cursor (the link is cursor://anysphere.cursor-deeplink/mcp/install?name=orishare&config=eyJ1cmwiOiJodHRwczovL2FwaS5vcmlzaGFyZS5jb20vbWNwL2Nvbm5lY3QifQ==, where config is the base64 of {"url":"https://api.orishare.com/mcp/connect"}).

Sign-in by hand. Add this to ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "orishare": {
      "url": "https://api.orishare.com/mcp/connect"
    }
  }
}

Cursor shows a sign-in button for the server in its MCP settings.

Access key.

{
  "mcpServers": {
    "orishare": {
      "url": "https://api.orishare.com/mcp",
      "headers": {
        "Authorization": "Bearer opat_..."
      }
    }
  }
}

VS Code

One-click install. Add Orishare to VS Code (the link is vscode:mcp/install? followed by the URL-encoded {"name":"orishare","type":"http","url":"https://api.orishare.com/mcp/connect"}).

Sign-in by hand. Add this to .vscode/mcp.json in your workspace:

{
  "servers": {
    "orishare": {
      "type": "http",
      "url": "https://api.orishare.com/mcp/connect"
    }
  }
}

VS Code asks you to sign in when it starts the server.

Access key. VS Code prompts for the key once and stores it securely:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "orishare-key",
      "description": "Orishare AI access key",
      "password": true
    }
  ],
  "servers": {
    "orishare": {
      "type": "http",
      "url": "https://api.orishare.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:orishare-key}"
      }
    }
  }
}

Codex

Sign-in. Add this to ~/.codex/config.toml:

[mcp_servers.orishare]
url = "https://api.orishare.com/mcp/connect"

Then sign in:

codex mcp login orishare

Access key. Put the key in an environment variable (ORISHARE_TOKEN=opat_...) and point Codex at it:

[mcp_servers.orishare]
url = "https://api.orishare.com/mcp"
bearer_token_env_var = "ORISHARE_TOKEN"

Any other client, or plain HTTP

Any MCP client that speaks streamable HTTP works with either URL. To check a key by hand, list the tools:

curl -s https://api.orishare.com/mcp \
  -H "Authorization: Bearer opat_..." \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-06-18" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The same key works on the REST API too, for example GET /v1/users/me:

curl -s https://api.orishare.com/v1/users/me -H "Authorization: Bearer opat_..."

What the AI can do

• It acts as you. Every call runs as your user, limited by your role in the organization. Full access means everything your role allows, never more.
• Only what you granted. The organization, the environments and the access level you chose on the consent screen (or set on the key) bound every call. Other organizations look like they do not exist; other environments cannot be selected.
• Live environments follow their autonomy setting. In a live environment, changes go through change sets and apply only as far as the environment's autonomy policy allows; otherwise they wait for a person to confirm. A connection never bypasses that.
• It can send events and act for your players in the chosen environments. Your organization needs no API key for that, and the AI never sees one: events, customer sessions (act_as_customer), backend merges and match results run with keys the Orishare server holds for each granted environment. Every such call is checked against your role and the connection, judged by the live environment's autonomy setting like any other change, and recorded in the audit log under your user and the connected app.
• Short-lived tokens. A sign-in connection uses access tokens that last 1 hour; your AI app refreshes them automatically, without asking you again.
• One switch to stop it. Disconnecting the app (or revoking the key) in Settings → AI connections revokes everything at once.

An AI connection (a sign-in connection or an AI access key) cannot create API keys or personal access tokens, or list or revoke your other tokens, and a sign-in connection cannot create organizations. It never needs a key: it runs events, customer sessions and the other key operations through call_action with the key the Orishare server holds. Inviting people, changing roles and transferring ownership always happen in the dashboard, whatever the connection. Organization-wide changes an AI may propose (projects, environments) need a connection that covers every environment of the organization; a connection that covers every environment also reads organization-wide pages such as pricing and AI usage.

Agents without a person

Nothing changes for an AI agent working on its own: it connects to https://api.orishare.com/mcp with no credential, gets the signup tools and signs up itself. See Start here for AI agents.

For AI app developers

Orishare is an OAuth 2.1 authorization server following the MCP authorization specification, revision 2026-07-28.

• Metadata: authorization server at https://api.orishare.com/.well-known/oauth-authorization-server; protected resource at https://api.orishare.com/.well-known/oauth-protected-resource/mcp/connect (and /.well-known/oauth-protected-resource/mcp). An unauthenticated request to the connector URL answers 401 with a WWW-Authenticate header naming the resource metadata.
• Authorization code flow only, with PKCE S256 required. The authorization response always carries iss (RFC 9207); check it.
• Client registration: Client ID Metadata Documents are supported and preferred (an HTTPS URL as client_id, whose document's client_id equals that URL). Dynamic Client Registration is available at https://api.orishare.com/oauth/register for clients that need it.
• Resource indicator: send resource set to the MCP URL you connect to (https://api.orishare.com/mcp/connect or https://api.orishare.com/mcp). Tokens are bound to it.
• Redirect URIs must match exactly, except loopback redirects (http://localhost, http://127.0.0.1, http://[::1]), where the port is ignored.
• Tokens: access tokens last 1 hour. Refresh tokens rotate on every use; presenting a refresh token that was already used revokes the whole connection.
• Authorization codes are single use and live 60 seconds. Presenting a code a second time revokes the whole connection made from it (OAuth 2.1, section 4.1.2): the token endpoint answers invalid_grant saying so, and the person connects again. Exchange each code exactly once and never retry a code exchange that may have succeeded.
• Endpoints: authorize at https://api.orishare.com/oauth/authorize, token at https://api.orishare.com/oauth/token, revocation at https://api.orishare.com/oauth/revoke (RFC 7009).

Every connection needs the person's consent on the Orishare consent screen; approving one app never approves another.