Skip to main content
The MCP server accepts two kinds of credentials, and the difference is not a setup preference. It decides what the assistant can see. Claude and ChatGPT always use OAuth. Claude Code, Codex, Cursor, Gemini CLI, VS Code, and Windsurf support both, and you choose by what you put in their config file: leave the credential out and the client signs you in over OAuth, supply one and the client reaches the whole workspace. Antigravity is set up with a key; its OAuth support is not documented here. Both routes hit the same server and expose the same tools.

​
OAuth, scoped to you

The assistant acts as the person who approved the connection. Every tool call runs with that person’s permissions: lists and searches come back filtered to what they can see, and a client or project they cannot open is refused rather than returned. That makes OAuth the better fit whenever a real person is driving the assistant, because the blast radius of the connection is the same as the blast radius of that person’s account. There is nothing to create in NeetoInvoice beforehand. You give the client the server URL and it works out the rest on its own. The server publishes its OAuth metadata at https://connect.neetoinvoice.com/.well-known/oauth-authorization-server, and registers each client automatically, so there is no client ID or secret for you to create. Registration accepts loopback redirect URIs, the local callback address a terminal or editor client listens on. Claude Code, Codex, Cursor, Gemini CLI, VS Code, and Windsurf therefore complete the same browser sign in that Claude and ChatGPT do.

​
What you approve

The approval screen has a What this connection can do section. Reading and staying connected are always granted; creating and deleting are the two you choose.
NeetoInvoice 'Authorize access' screen showing the workspace and signed-in email, a 'What this connection can do' list with Read and Stay connected always granted and Create and update and Delete as tickable boxes, a 'Workspaces to connect' list, and Cancel and Authorize buttons

The approval screen, with the scope picker and the workspace list.

A scope you leave unticked is enforced when a tool is called, not silently ignored: the tool is refused with a message naming the permission it needed. A connection approved for reading only can list time entries and check unbilled totals, but cannot log time, generate an invoice, or delete anything. What you see when you connect:
  1. Connect your workspace. Enter the subdomain of the workspace you want the assistant to reach. For acme.neetoinvoice.com, enter acme. See Workspace subdomain.
NeetoInvoice dialog headed 'Connect your workspace' with a field for the workspace subdomain, a .neetoinvoice.com suffix, and a Continue button

The first screen of the NeetoInvoice OAuth flow.

  1. Sign in to that workspace, if you are not signed in already.
  2. Check the approval screen. It names the workspace, the email you signed in as, and the host the client sends you back to, and it shows the scope picker above. When your email belongs to more than one workspace, it also lists them under Workspaces to connect; the one you signed in to is ticked and cannot be unticked.
  3. Authorize. The assistant is granted access as you, with the scopes you ticked, to each workspace you ticked.
One OAuth connection can therefore cover several workspaces. Name the one you mean in a prompt, or ask the assistant to list what it can reach. Every tool takes an optional workspace argument for this.

​
API key, scoped to the workspace

An API key carries no identity. Every tool call covers the entire workspace, no matter whose machine the assistant is running on or who is typing. Role checks do not run at all, so a key hands its holder more reach than their own role allows, and two people sharing one key are indistinguishable to NeetoInvoice. That is what you want for automation that has to see every time entry, and what you do not want on a laptop belonging to someone who should only see their own. The key is the same one the REST API uses, sent as a bearer token:
That block goes inside the server entry in the assistant’s config file rather than on its own. Connect has the complete file, in the right format, for each client. API keys are created in your NeetoInvoice workspace settings. Learn how to generate your API key here.
A key belongs to one workspace. To let an assistant work with two workspaces, add the server twice with a different key and a different server name in each entry.
An API key gives access to every client, project, and time entry in the workspace, and is not tied to a person, so it cannot be traced back to one either. It reaches every user’s time entries and the payroll and PTO reports, not just your own. Treat it like a password: keep it out of shared config files and commits, and revoke it if it leaks. Prefer OAuth wherever the client supports it.

​
How the three interfaces authenticate