What you'll achieve
An MCP client can use only the approved workspace capabilities and every grant has a visible owner.
Prepare the connection
- Confirm that the client supports OAuth 2.0 and that its redirect URI is the one shown by the client.
- Choose a workspace owner for the connection. Do not share a personal token between tools or teammates.
- Decide the smallest read or write capabilities the client needs before approving the request.
Approve the MCP client
Start the connection from the MCP client. DobroDesk opens an authorization page at /oauth/authorize.
Sign in to the intended workspace, review the client name, redirect URI and requested capabilities, then choose Allow only when they match the approved request.
Return to the MCP client and run a read-only test. Check that the result is limited to the selected workspace and capabilities.
Review or revoke access
Open Settings > Integrations > API tokens and switch to MCP clients.
Review the client, last use and granted scope. Select Disconnect when the tool is retired, the owner changes or the grant may be exposed.
Remove the grant in the client as well, then create a new grant only after its redirect URI and capabilities have been reviewed.
Disconnecting an MCP grant does not delete conversations or customer data. It stops that client from using DobroDesk until a new grant is approved.