Normal Answer Cloud agent access uses browser OAuth at https://app.answer.cloud/mcp. You sign in and approve access in your browser; the assistant then uses the resulting connection to call organization-scoped tools.
Select the intended account and organization#
The browser sign-in account determines which organizations can be authorized. After connection, the assistant should call list_organizations when no organization has been established. If several are available, choose one and keep its organization_id on subsequent requests.
Within that organization, use list_sites to confirm the site's slug, kind, and public URL. A site slug identifies a site; a deployment ID identifies a particular deployment. Do not use a similarly named site in another organization as a substitute for missing access.
OAuth access does not bypass plan requirements. For example, custom-domain, GitHub, CMS, chat, or reporting operations can still be unavailable for the selected site. Inspect its feature access and the exact error before changing configuration.
Temporary first-launch access is separate#
The public launch workflow can reserve and publish a starter site without browser sign-in. Its temporary build credential is restricted to that new reservation, expires, and has a bounded deployment allowance. It grants no access to an existing account's other sites.
Completing account setup revokes that temporary build access. Ongoing edits then require a normal authenticated connection that can see the existing organization and site. Do not save the temporary token into global MCP settings or recreate the site to avoid an expired credential.
Reconnect when access fails#
- Inspect whether the client is connected to the exact
/mcpservice URL. - Reconnect
answercloudin the client's MCP settings and complete browser OAuth. - Use the account that owns or has access to the intended organization.
- Repeat the read-only organization and site checks.
For personal OAuth connections, do not add a static Authorization header; it can disable the discovery flow. If a client does not offer OAuth or Streamable HTTP, use a supported client instead of trying to paste a secret into a generic header field.
When you want an assistant to stop accessing your account, disconnect or remove its Answer Cloud connection in that client's settings. This removes that client's usable connection; do not assume it is an account-wide revocation of every separately authorized client. Contact support if you need broader access investigation or cannot complete recovery.
Keep private information private#
Never share passwords, browser verification codes, private emailed claim links, bearer credentials, or signed upload URLs in public source or screenshots. Project instructions can safely record organization ID, site slug, public hostnames, and build commands. Store credentials through the client's supported authentication mechanism rather than in the website repository.