- Claude Code
- Cursor
- Codex
- Other
How sign-in works
MCP clients sign in with the browser flow OAuth 2.1 describes for public clients: an authorization code with PKCE and no client secret, and an access token scoped to the workspace you pick on the consent page. (The CLI’soutcrawl login reaches the same account through the device flow instead, because a terminal has no browser redirect to catch.) A client that has never connected before registers itself automatically; there is nothing to create by hand. Removing a member from a workspace cuts off every token their sign-in produced, immediately.
Rate limiting
Shared with the REST API: every request against your plan’srequestsPerMinute ceiling, the MCP server included. See plans for the figure per tier.