Skip to main content

Authentication

Viewfield's MCP server uses API key authentication. Every request carries your key as a Bearer token, and the key identifies your workspace and acts as the member who made it. There is nothing else to configure.

Create an API key​

  1. Sign in to Viewfield, open the workspace menu at the foot of the rail, then Workspace settings › MCP (or go to /settings/mcp).
  2. Under Create a key, type a name for the integration that will use it ("Claude Code agent", "CI pipeline").
  3. Press Create.
  4. Copy the key at once; it is shown only once. Keys look like sk_ followed by 64 hexadecimal characters, and the list shows only their first characters.

Any member can create keys for their own use, contributors included; a workspace holds at most 20 live keys, and a member creates at most 10 an hour. The workspace needs an active plan or trial. A key scopes every call to one workspace; an agency's agent scoped to one client sees only that client. A key nobody has used for 90 days is marked stale in the list.

Use the key​

The @viewfieldai/mcp package connects a client in one command and prompts for the key:

npx @viewfieldai/mcp install

To configure a client by hand, the key rides in env and the package bridges to the endpoint:

{
  "mcpServers": {
    "reactor": {
      "command": "npx",
      "args": ["-y", "@viewfieldai/mcp"],
      "env": { "REACTOR_API_KEY": "YOUR_API_KEY" }
    }
  }
}

See Install the MCP for every client.

What a key may do​

A key acts as the member who made it, with that member's live role: a contributor's key cannot change Brand or edit the questions, a manager's can, and a demotion takes effect on the next request. Keys carry no scopes of their own, and there is no OAuth. Removing a member revokes their keys, and every request re-checks that the key's owner is still a member. Managers and owners see every key in the workspace and can revoke any of them, except that only the owner revokes the owner's own keys; contributors see and revoke their own.

Saving a draft or a page change in your CMS, and publishing it, are never a key's: those are a person's press in the app.

How it is stored​

Viewfield stores only a SHA-256 hash of your key, never the plaintext. On each request it hashes the presented key, matches it to the stored hash and resolves the workspace. If you lose a key, create a new one and revoke the old entry.

Security notes​

  • Do not commit API keys to source control; the installer offers to ignore the project config files that hold one.
  • Use a separate key per integration so you can revoke one without disrupting the others.
  • Keys are valid until you revoke them; there is no automatic expiry.
  • Revoking a key takes effect immediately; any client using it starts getting 401s.
  • The bridge sends your key only to Viewfield's own hosts, or to a loopback address for local testing (the only place plain http is allowed), unless you name another host in its own config file; see the package's README for the rules.

Rate limits and errors​

Each key may make 120 requests a minute, and each workspace 120 tool calls a minute; one request may carry at most 25 messages. Some tools have their own budget per workspace a minute: draft_piece 20, import_content 10, ai_edit_content 30, verify_claims 4, and review_copy and revise_copy 20 between them. Tool calls that read an outside source (your site, the live web) are also subject to that source's own limits.

ErrorCause
400 Bad RequestThe body is not valid JSON
401 UnauthorizedMissing, malformed or revoked API key, or the key's owner is no longer a member
402 Payment RequiredThe workspace has no active plan or trial
403 ForbiddenThe workspace is suspended
405 Method Not AllowedAnything but POST
413 Payload Too LargeMore than 25 messages in one request, or a body over 4 MB
429 Too Many RequestsA rate limit was reached, or too many failed keys from one address in a minute; Retry-After says when