Skip to main content
Everyone·Getting Started

Connect an AI Assistant with OAuth

What happens when an AI assistant asks to connect to MentorStack with a sign-in and consent screen instead of a pasted API key. A MentorStack help center guide.

Some AI assistants connect to MentorStack by sending you to a MentorStack sign-in and consent screen. You approve the connection there, and you do not copy an API key by hand. This page covers that approval flow. To set up an assistant with a pasted API key, and for the list of what an assistant can do, see Connect AI Assistants with MCP.

The server address the assistant connects to is the same one the MCP guide uses: https://app.mentorstack.co/api/mcp.

Approve a connection

  1. In your AI assistant, add MentorStack as a connection and start the sign-in. The assistant opens a MentorStack page in your browser.
  2. If you are not signed in, sign in to MentorStack. You return to the consent screen afterward.
  3. On the Authorize Access screen, read the app name, the organization, and the address under After authorizing, you'll be redirected to.
  4. Click Authorize. MentorStack sends you back to the assistant, which finishes the connection.

Click Cancel to refuse. MentorStack sends you back to the assistant and tells it that access was denied.

  • App name. The name is chosen by the app itself, and the screen says so: "name self-declared by the app".
  • An Unverified application warning. MentorStack does not verify who owns an app that asks to connect. Authorize only apps you trust.
  • What the app can do. It can reach your mentorship data through the MCP API and read and write on your behalf. The scope shown is either Participant (read/write) or Admin (full access).
  • Organization. The organization your account belongs to.
  • The redirect address. The site you return to after you click Authorize. Check that it is the site you expect.

Warning

Check the app name and the redirect address before you click Authorize. Anyone can register an app under any name, so the name alone does not prove who the app is.

Participant and admin access

A participant connection can only reach your own data, the same as a participant API key. The Admin (full access) option is only available to admin accounts. If a non-admin account opens a link that asks for admin access, MentorStack does not show the consent screen. See API Keys for how the two key levels differ.

After you approve

Approving creates an access key for the assistant. The key:

  • appears under Settings → API & Integrations with a name that starts with OAuth (, followed by the first characters of the app's ID.
  • expires 30 days after it is created. After that, the assistant has to ask you to approve again.
  • can be revoked at any time with Revoke. The assistant loses access right away.

The approval is single use and expires 10 minutes after you click Authorize. If the assistant does not finish within 10 minutes, start the connection again.

If it does not work

  • You are sent to the home page instead of the consent screen. The link is missing information, the app is not registered, or your account is not an active member of an organization. Start the connection again from the assistant.
  • You are asked to set up two-factor authentication. If your organization requires two-factor authentication and you have not set it up, approval is refused. See Two-Factor Authentication.
  • The assistant says it has lost access. The key may have expired after 30 days or been revoked. Approve a new connection.

Note

Connecting this way follows the same rules as an API key. Treat an approved assistant like a person with your login: it can act as you inside MentorStack until the key expires or you revoke it.

Related Articles