MCP server adds OAuth sign-in
Released: October 9, 2026
MCP server Added
Section titled “MCP server ”https://api.kirimdev.com/mcp now supports OAuth 2.1 as defined by the MCP
authorization spec (revision 2026-07-28). An OAuth-capable client only needs the
URL: it opens a browser, you sign in to Kirimdev, pick the organization, and
approve the permissions.
- Owners and admins only. MCP tools act across the whole organization, so agents cannot authorize a client. Membership and role are checked on every request — removing or demoting a member cuts off their connections immediately.
- One organization per connection. Members of several organizations choose one during sign-in.
- Scoped permissions:
mcp:read(read tools),mcp:write(contacts, labels, templates, customers, mark as read) andmcp:send(send_message), chosen with checkboxes on the consent page — sending is off unless you tick it. A call outside the granted scopes returns403 insufficient_scope, which lets the client ask you for more access. - Client identity uses OAuth Client ID Metadata Documents. Dynamic Client Registration is not offered; clients that only support it can keep using an API key.
MCP server Changed
Section titled “MCP server ”A request without credentials still returns 401 with the
missing_api_key error, and now also carries a
WWW-Authenticate: Bearer resource_metadata="https://api.kirimdev.com/.well-known/oauth-protected-resource/mcp"
header so clients can discover the sign-in flow. Bearer API keys
(kdv_live_…) work exactly as before.
Every tool that changes data (send_message, mark_as_read, contact,
label, template and customer writes, start_bulk_label_by_message) is now
annotated destructiveHint: true; read tools stay readOnlyHint: true.
Clients such as Claude therefore ask before each write instead of running it
automatically. API-key and OAuth connections behave the same.
Tool calls made over OAuth do not appear in the dashboard’s API request logs yet; API-key calls are logged as before.