Authentication & Scopes
The MCP server accepts two kinds of credential: an OAuth access token obtained by signing in through your assistant, or a Public API key you create in the dashboard. Both are checked on every request and both carry scopes.
Signing in (OAuth)
Clients that support OAuth — Claude, ChatGPT, Cursor — can connect without you handling a secret at all. Point them at https://api.dialora.ai/mcp and they discover Dialora’s authorization server automatically through the standard metadata endpoints, register themselves, and send you to sign in.
Dialora implements the OAuth 2.0 authorization code flow with PKCE (S256), refresh tokens, and dynamic client registration. Access tokens are short-lived (one hour) and refreshed by your client in the background.
The consent screen
After you sign in you approve exactly what the assistant gets:
- Which app is asking — its registered name and the host it will redirect back to
- Which account it may act on, when you have more than one
- Which permissions, grouped by resource (Calls, Users, Plans, Subscriptions), each offering a read level and a write level
Read levels are pre-selected; write levels are not. Read and Write shortcuts let you grant a whole tier at once. Denying cancels the connection and returns the assistant empty-handed.
API keys
The MCP server authenticates with the same Public API keys used by the REST API. Send the key as a bearer token on every request:
Authorization: Bearer dlr_live_xxxxxxxxxxxxxxxx| Key prefix | Endpoint |
|---|---|
dlr_live_… | https://api.dialora.ai/mcp |
The server validates the key on every request — revoked, disabled, or expired keys are rejected with 401 unauthorized.
Scopes
Each tool maps to a scope. The server only exposes the tools your key is entitled to — a tool whose scope (or key tier) your key lacks is not registered, so it never appears in the assistant’s tool list. Grant only what the assistant needs.
| Scope | Grants | Tools |
|---|---|---|
calls:read | Read calls & transcripts | list_calls, get_call |
calls:write | Place / manage calls | create_call |
users:read | List end users | list_users |
users:write | Create / delete end users | create_user, delete_user |
plans:read | List plans | list_plans, get_plan |
subscriptions:read | Read subscriptions | list_subscriptions, get_subscription |
subscriptions:write | Create / change subscriptions | create_subscription, update_subscription_plan |
Account keys vs. tenant (agency) keys. Keys created by a regular user from the profile avatar (top right) → API Keys can only grant calls:read and calls:write. The users, plans, and subscriptions scopes are reserved for tenant-level keys issued from the agency dashboard.
Tenant isolation
A key is bound to one Dialora tenant (and, for account keys, one account). Tools only ever see and act on data belonging to that tenant — there is no way for a key to reach another customer’s data.