MCP reference and troubleshooting
Manage MCP keys
Open User Menu → MCP to view each key’s name, authorization mode, grants, security level, session duration, last use, and enabled status.
- Edit: change grants, authorization mode, security level, or session duration.
- Regenerate: creates a new key value and invalidates the old one immediately. Update every client that used the old key.
- Disable: blocks the key at the server while retaining it for later re-enable or investigation.
- Delete: permanently removes the key.
Use Connected apps on the same MCP area to inspect or revoke OAuth grants.
Troubleshooting
OAuth client cannot connect
Confirm the configured endpoint is https://mcp.quave.cloud/. If the client
supports Dynamic Client Registration and has an optional Client ID field,
leave that field empty for supported clients such as the documented Claude and
Cursor MCP flows. Quave ONE should register the client during the OAuth flow.
Dynamic Client Registration requires the client’s complete callback URI set to match a trusted Quave ONE callback profile exactly. If a supported client says registration failed or asks for a client ID, collect the client’s registration reference or callback URI set and ask Quave ONE support to update the trusted profile. Use a static client ID only for custom clients or as a support-guided fallback.
Invalid or disabled MCP key
Check that the raw key is in the Authorization header, with no Bearer
prefix. Then verify the key is enabled and has not been regenerated. Create a
separate replacement key instead of sharing another client’s key.
“MCP keys cannot be used directly”
This is expected when a key is sent to the Public API. MCP keys are accepted by the MCP server only. Use a Public API token or Public API OAuth for direct API automation.
Insufficient scope or tool not selected
Reconnect and request the required OAuth capability, or edit the MCP key’s permissions/allowlist. A client cannot expand its own access without a new server-authorized grant.
No confirmation prompt
Security level and session duration are client features. The operation can still be denied by Quave ONE if its authorization grant, key, role, or environment permission is insufficient.
FAQ
Do OAuth and MCP keys coexist? Yes. OAuth is recommended, and keys remain supported unless the account enables OAuth-only automated access.
Can I use one OAuth token for MCP and the Public API? No. OAuth tokens are bound to one protected resource. Obtain separate MCP and Public API grants.
Can I use MCP keys in CI/CD? Use Public API tokens or Public API OAuth for non-interactive automation. MCP keys are intended for MCP clients.
Are keys encrypted? Yes. Quave ONE encrypts MCP keys at rest. The plaintext value is shown only when it is created or regenerated.
Can a modified client bypass authorization? No. It may bypass its own confirmation UI, but Quave ONE still enforces authorization and platform permissions on every request.