Skip to main content
Your OnePatch workspace exposes an MCP server over streamable HTTP. Everything it returns is scoped to your organization. The only writes are starting a chat and replying to one.
To connect a coding agent or editor, see Coding agents.

OAuth

The first call from an MCP client opens an OAuth sign-in with your OnePatch account.

API keys

OAuth needs a browser. For a script, CI job, or unattended agent, use an API key: an org admin creates one on the Integrations page under API keys. You get a client_id / client_secret pair, and the secret is shown once. The pair doesn’t expire; your code exchanges it for a 1-hour access token and sends that as the MCP bearer:
Any MCP client that can send a static Authorization header works the same way. Each key is bound to one organization; its tokens can’t read another customer’s data. Rotate issues a new secret while the old one keeps working. Once the new secret is deployed, Retire old secret deletes the old one. Revoke deletes the key and every secret on it.

Tools