https://api.zippendo.com/mcp) is protected by OAuth 2.1. You never
paste a token — your client discovers the login flow from the URL, opens your browser, and you sign
in to Zippendo and approve access. This page explains what happens and what you control.
The connection flow
When you add the URL to a client and connect for the first time:1
Your client discovers the login
The server responds to the first unauthenticated request with a pointer to its OAuth metadata.
Your client registers itself automatically (no client ID to create) and opens your browser.
2
You sign in to Zippendo
If you’re not already signed in, you’ll land on the Zippendo sign-in page. Sign in as you
normally would.
3
You approve access on the consent screen
Zippendo shows a branded consent screen with the client’s name, the organization to connect,
and the scopes being requested. Choose the org, tick the permissions you want to grant, and
approve.
4
You're connected
The browser hands control back to your client, which stores its tokens and refreshes them on its
own. You won’t need to sign in again until access is revoked or expires.
Choosing an organization
Each authorization is bound to one organization. On the consent screen you pick which org the agent may act in, and every tool call is isolated to that org. To work in a different organization, connect again and choose the other org on the consent screen — or, in clients that allow more than one server entry, add a second connector with the same URL and authorize it for the other org.Narrowing scopes
The consent screen lets you grant a subset of the requested permissions — you can’t grant more than was asked. Grant only what the agent needs (least privilege):- Read-only assistance? Grant just the
read:*scopes. - Should it create and send shipments? Add
write:shipments.
The agent acts as you, only inside the org and scopes you approve, and never with admin
privileges. Every tool call runs the same authentication, scope checks, billing limits, and
validation as a normal API request.
Tokens and refresh
For the remote OAuth connection, your client manages tokens for you:
You don’t handle these directly — the client stores and refreshes them.
Disconnecting
To stop an agent’s access, remove the connector in your client (for example,claude mcp remove zippendo, or delete it from your client’s MCP/Connectors settings). Because
access tokens are short-lived, access ends within about an hour even if a token was already issued.
There is no server-side “connected apps” screen today. Revocation is done from the client that holds
the connection. Because access tokens are short-lived (about an hour), removing the connector cuts
off access quickly even if a token was already issued.
For developers: discovery endpoints
The API is its own OAuth 2.1 authorization server. Standard discovery endpoints are public:
A compliant MCP client handles all of this for you — you only ever provide the URL.