Skip to main content
AutoFire MCP accepts two kinds of credentials. Both are permanently tied to one dealership.

​
Sign in with AutoFire

  1. In the AI app, add a remote MCP server with the URL https://mcp.goautofire.com/mcp.
  2. The app opens AutoFire in your browser. Sign in if you are not already.
  3. Choose the dealership the app may read and the permissions it gets. Everything is read-only.
  4. Select Allow. The browser returns to the app, which can now call the tools you permitted.
The app appears under Dashboard → MCP & API → Connected AI apps, with who connected it, its permissions, and when it was last used. Disconnect cuts its access immediately.
Any accepted member of the dealership’s team (owner, admin, or staff) can complete the consent screen. Accounts that are not on a team see an explanation instead of the Allow button.
Each sign-in is bound to one dealership. Connecting the same app to a second dealership moves the connection; connect from a second AutoFire account if an app needs both.

​
Technical details

  • Authorization server: AutoFire’s hosted Supabase Auth issuer, discovered through the protected-resource metadata at https://mcp.goautofire.com/.well-known/oauth-protected-resource/mcp (the origin-level document is served too).
  • Grant: OAuth 2.1 authorization code with PKCE (S256 required), refresh tokens with rotation.
  • Client registration: dynamic client registration (RFC 7591). Pre-registered clients are not required.
  • OAuth scope: email. AutoFire permissions (inventory:read and the others) are chosen on the consent screen and enforced server-side on every call; they are not carried in the token.
  • Unauthenticated requests receive 401 with WWW-Authenticate: Bearer resource_metadata="…".

​
Bearer keys

​
Who can manage keys

Every accepted team member can create keys and connect apps for their dealership. Staff see and revoke only their own; the owner and admins see and revoke everyone’s. Keys and connections stop working as soon as their creator leaves the team. A dealership can have five active keys at a time.

​
Expiration choices

Every key expires after exactly 30, 60, or 90 days. AutoFire allows at most five active keys per dealership. Use a separate, clearly named key for every client or automation so you can revoke one connection without disrupting another.

​
One-time display

The complete key is shown once. AutoFire stores a keyed one-way digest plus a short prefix for identification—not the reusable secret. If you lose a key, revoke it and create a replacement.

​
Sending the key

Do not put the literal key in shell history or client configuration when the client supports an environment variable or secret store.

​
Rotation

  1. Create a replacement key with the same or narrower permissions.
  2. Update the client secret.
  3. Verify one tool call.
  4. Revoke the old key.

​
Monthly allowance

Keys and signed-in apps share one monthly tool-call allowance per dealership, set by its plan. See MCP security.