**Settings → MCP & API Keys** is where you connect AI tools to your TrackIQ data, and where you check what they have been asking.

The page is deliberately lopsided. Almost everyone needs only the first card. Everything below it is labelled **Advanced** because it genuinely is.

[Watch the walkthrough](https://kb.trackiq.com/kb-assets/kbvideo-mcp-console-explainer-ea4d8093.mp4)

*Prefer to watch? Ninety-nine seconds on the one card that matters, and why there is no secret to store.*

## **The whole page in one screen**

![The MCP access console](/kb-assets/shot-b35-mcp-console-964da1.png)

Three things live here:

**The guided connect card** — one URL, four steps, no credentials.

**Advanced** — manual OAuth clients and per-brand API keys, for clients that cannot self-register.

**Call Logs** — top right. What the connected tools actually asked. See [**MCP Call Logs: Seeing What Your AI Tools Asked**](https://kb.trackiq.com/hc/knowledge-base/articles/mcp-call-logs).

## **The one URL**

```
https://app.trackiq.com/mcp
```

There is a **Copy** button beside it. That single URL is the entire configuration for any client that supports OAuth Dynamic Client Registration — Claude Desktop being the common case.

The four numbered steps on the card are the whole procedure:

**1. Open the custom connector dialog.** In Claude Desktop: **Settings → Connectors → Add custom connector**.

**2. Paste the URL.** The client registers itself with TrackIQ. Nothing to copy back.

**3. Pick a brand and approve.** A TrackIQ tab opens in your browser. You choose which brand the connector may query, then approve.

**4. Ask a question.** *"List my marketplaces"* is the standard smoke test.

**Step 3 is the security boundary.** The connector is scoped to the brand you pick at that moment, in your browser, on a TrackIQ page. Nothing you paste into the AI tool grants access — approval happens on TrackIQ's side.

## **Why there are no credentials to handle**

Dynamic Client Registration means the client asks TrackIQ for its own identity, and TrackIQ issues one. No client ID to copy, no secret to store in a config file, no token that leaks if someone screenshots your terminal.

That is the reason to prefer the top card over anything in Advanced whenever your tool supports it.

## **Advanced: when the top card is not enough**

![Manual OAuth clients and per-brand API keys](/kb-assets/shot-b35-mcp-advanced-87bb1d.png)

The section carries its own warning, and it is accurate:

> Most customers don't need anything below.

Two mechanisms sit here, for two different kinds of client.

### **Manual OAuth clients**

Pre-issued `client_id` / `client_secret` pairs, for **OAuth-aware clients that do not yet support Dynamic Client Registration**.

The brand is still chosen at connect time on the consent screen — a manual client does not pre-bind a brand.

**Use for:** Cursor (current versions), in-house OAuth-aware integrations, OAuth proxies.

**Do not use for:** Claude Desktop. Paste the URL at the top of the page instead.

**+ New Client** creates one.

### **Per-brand API keys**

Long-lived bearer tokens **scoped to a single brand**, sent as `Authorization: Bearer …` on every request.

**Use for:** `curl`, Postman, `claude mcp add` via the CLI, the older `mcp-remote` bridge, server-to-server scripts — anything that does not speak OAuth at all.

Keys are listed per brand, each with a live count: *0 active · 0 revoked*. **+ New Key** generates one for that brand.

**The scoping is the point.** A key cannot reach a brand it was not issued for, so a script that only needs one brand should hold a key for only that brand.

## **Choosing between the three**

| Your client | Use |
|---|---|
| Claude Desktop | **the URL at the top** |
| Cursor, OAuth-aware but no DCR | **manual OAuth client** |
| `curl`, Postman, a script, a cron job | **per-brand API key** |
| Claude Code CLI | **API key** via `claude mcp add` |

There is also a **Setup instructions for Cursor, Claude Code, & direct API** button in the Advanced panel, which expands the client-specific detail. See [**Installing TrackIQ MCP in Claude, ChatGPT and Cursor**](https://kb.trackiq.com/hc/knowledge-base/articles/installing-trackiq-mcp-in-claude-desktop-and-cursor).

## **Operating it safely**

**Issue the narrowest thing that works.** An API key for one brand beats an OAuth client that can reach any brand you approve.

**Revoke rather than delete-and-forget.** The active/revoked counts on each brand card are there so you can see what is outstanding.

**Check Call Logs after connecting a new client.** It shows the questions asked and which TrackIQ tools each one used, which is the quickest confirmation that a connection is working and being used as expected.

**Nothing here can change your advertising.** MCP is read access. A key cannot move a bid, a budget or a rule — so the risk from a leaked key is disclosure, not damage. That is still worth avoiding.

## **Related**

- [**What Is MCP, and Why It Matters**](https://kb.trackiq.com/hc/knowledge-base/articles/what-is-mcp-and-why-it-matters) — the concept.
- [**Installing TrackIQ MCP in Claude, ChatGPT and Cursor**](https://kb.trackiq.com/hc/knowledge-base/articles/installing-trackiq-mcp-in-claude-desktop-and-cursor) — per-client setup.
- [**MCP Call Logs: Seeing What Your AI Tools Asked**](https://kb.trackiq.com/hc/knowledge-base/articles/mcp-call-logs) — the audit trail.
- [**MCP Tiers: What Each Plan Unlocks**](https://kb.trackiq.com/hc/knowledge-base/articles/mcp-tiers-what-each-plan-unlocks) — which tools your plan exposes.
- [**Feed TrackIQ Data into Your Own AI Workflow**](https://kb.trackiq.com/hc/knowledge-base/articles/feed-trackiq-into-your-ai-workflow) — what it is actually good for.