Authentication and permissions

Claude Code signs in to APIANT with OAuth in your browser, and every tool call it makes acts as the APIANT user who signed in. The server URL and the server registration carry no user identity, so the account Claude works on is decided on the sign-in page, not by where you copied the command.

The client calls https://mcp.apiant.ai/mcp without a token and receives 401 with a pointer to the discovery metadata.
It reads the metadata, registers itself with APIANT (dynamic client registration), and opens the authorization page at https://app.apiant.ai/oauth/login in your browser.
You sign in and approve the request.
APIANT redirects back to the client with a single-use authorization code, which the client exchanges for tokens using PKCE.
The client sends the access token on every request and renews it with the refresh token.

The Authorize access step names the application, what it is asking to do, and the account you signed in as.

Step	What you see
Sign in	Email and Password, or Continue with Google or Continue with GitHub
Select your organization	Shown only when your email belongs to more than one organization
Enter verification code	Shown only when your account has two-factor authentication: the 6-digit code from your authenticator app
Authorize access	The application's registered name, what it is asking to do, the account under Signed in as, and Allow or Deny

Authorize access appears on every sign-in. Deny issues nothing and returns the client an access_denied error.

The client sign-in page has no password reset. To reset a forgotten password, use Forgot password? on the app.apiant.ai sign-in page, then start the client sign-in again.

Which account Claude acts as

Claude acts as the person and organization you signed in with on that page. To work on a different APIANT account from the same project, sign out and sign in again as that account:

In Claude Code, run /mcp, select apiant-ai, and choose Clear authentication.
Choose to authenticate again, and sign in as the other account.

Scopes

Scope	Grants
`mcp:tools`	Use the APIANT tools in your account: read and change your automations, assemblies and connections, and run them. Required for every tool call.
`mcp:automation_builder`	Build and edit automations on your behalf.

A sign-in that asks for no scope is granted both. Scopes do not narrow which tools a signed-in user can call; permissions and plan do.

Permissions

Permission or plan	Needed for
MCP Tools permission	Signing in from Claude Code. The default user role includes it. Without it, sign-in fails with "Your account does not have the MCP Tools permission required to use the plugin".
A plan that allows app authoring	Building or changing connectors, triggers and actions. Creating a connector can also require a permission on your role. See Build a connector, action or trigger.
Enterprise, with the matching permissions	Publishing between environments and deploying automations to other accounts

A tool call your account is not permitted to make returns a permission error and changes nothing. Ask your account administrator to change your role if you need a permission.

Tokens

Token	Lifetime
Authorization code	10 minutes, single use
Access token	30 days
Refresh token	10 years

Claude Code stores the tokens and refreshes the access token when it expires. You sign in again only after clearing authentication, after re-running the full install command, or when APIANT revokes the tokens, for example when the account is deactivated.

Re-running the install command signs you out

The full command from Connect to Claude Code runs claude mcp remove apiant-ai before adding the server again. Removing the server discards Claude Code's stored sign-in for it, so you authenticate again afterwards. To update the skills without signing out, run only the download half. See Connect Claude Code.

For some organizations, the command from Connect to Claude Code registers the server with an X-APIANT-Tenant header. The header ties sign-in, and every token issued, to that organization, while the server URL stays https://mcp.apiant.ai/mcp. The header value is stored in the server registration. If requests start failing with unknown tenant, copy the command from the dialog again, re-run it, and sign in again.

Message	Meaning
Your account does not have the MCP Tools permission required to use the plugin	Your role lacks MCP Tools. An administrator can add it.
Your account has been deactivated	The account was deactivated. Contact your administrator.
This account was closed because it had been inactive.	The account was closed for inactivity. The message includes a link to reopen it when one is available.
Access denied. You can close this window.	You selected Deny and the page could not return you to the client. Start the sign-in again from the client.