Hosted server and sign-in
Octri hosts every project's MCP server over Streamable HTTP. An MCP client connects to a URL, the person signs in once, and every publish in MCP Studio reaches every connected client with nothing to reinstall.
Addresses
| Address | What it serves |
|---|---|
/api/ | The whole server: documentation tools and every operation tool you left on |
/api/ | One tool group |
/api/ | A team installation with its own stored credential |
/api/ | Practice mode, with sample answers |
All of them sit on https://api.octri.dev, or on your own domain. MCP Studio shows each one ready to copy.
The hosted server calls only public addresses. To try an API on localhost or a private network, run @octri/mcp locally. See Transports.
Sign-in
Under Sign-in in MCP Studio, choose how the people who connect prove who they are to your API. Clients register themselves with the server, so there is no client ID to hand out.
With sign-in off, clients send the credential as a header on each request, and Octri does not store it:
| Your API's scheme | Header |
|---|---|
| Bearer or OAuth 2 | x-octri-api-token |
| API key | x-octri-api-key, plus x-octri-api-key-header if your header isn't X-API-Key |
| Basic | x-octri-api-username and x-octri-api-password |
Still accept credential headers keeps that working after you turn sign-in on, for scripts and CI.
Connected users
Everyone who signed in through OAuth or the key page is listed under Signed-in people, with the client they used and when it last made a call. End any grant from there and that client has to sign in again.
Installations for a team
An installation is a server address of its own backed by a credential you store, so a team can use the API without anyone pasting a production key into a JSON file. Choose who may use it:
- People on this project, signed in with Octri, who sign in with their Octri account.
- Anyone with its token, for scripts and shared agents.
- Anyone with the link, which is only offered for installations limited to tools that read.
Under What it may do, you can narrow an installation further:
| Option | What it does |
|---|---|
| Read-only | Only tools that read |
| Dry run | Builds each call and sends none |
These only narrow your published permissions, so a tool that asks first still asks.
Octri shows an installation's token once. If it's lost, choose Rotate token for a new one. Replace key swaps the stored credential, and Revoke deletes it, so every client using that installation stops on its next call.
Installations apply as soon as you save them; they don't wait for a publish. Stored keys live only on installations and never on the project's main address, which has no Octri sign-in of its own.
Your own domain
Serve the server at an address like mcp.acme.com. See custom domain.
From the CLI
Installations can be created, changed, rotated and revoked with octri mcp installations, and signed-in people listed and signed out with octri mcp connections.