Connect with sign-in

Most AI apps connect to Upscrape by signing in: you approve the app once in your browser and it never sees a key. You can take that access back at any time.

Connect

1. In your AI app, add a remote MCP server with this address:

   Server address Copy

   https://data.upscrape.com/mcp

2. The app opens Upscrape in your browser. Sign in if you aren't already.

3. Check what the app may do, then approve. The app is connected.

Your app's setup guide shows where step 1 is in that app.

What you allow

The approval screen says what the app asked for, and you can narrow it before approving:

• Run endpoints, or only read. Read-only lets the app search the catalog and read past results, but not run anything or spend credits.

• Which platforms. Limit the app to one platform, so it can't run anything else.

• Extra permissions, each off unless you tick it: your account's balance and usage, sending feedback, and collections.

Whatever you approve, the app can never do more than your account can. An app that may run endpoints can also read the results of other runs on your account; to keep it to its own platform, limit it to that platform. Limit what an agent can do lists every permission.

Disconnect an app

Every app you have connected is listed in the console under Connect, with when it was last active. Disconnect one and it stops working at once; it can come back only through a new approval. A connection never gains permissions by itself: to give an app more, disconnect it and connect again.

For client developers

• Two hosts. The MCP server is https://data.upscrape.com/mcp; the authorization server is https://app.upscrape.com. Follow the metadata the server publishes rather than building addresses, and don't add /mcp to the authorization host.

• The flow. Authorization code with PKCE (S256) for public clients, with dynamic client registration or a client-ID metadata document. Access tokens are bound to the MCP server as their audience.

• Scopes. One base scope, mcp or mcp:read, optionally narrowed by platform:<id> and capability:<id>. Extra features take their own scopes: mcp:account:read, mcp:feedback:read, mcp:feedback:write, mcp:collections:read, mcp:collections:write. The token response gives the scope the person approved, which can be narrower than requested; a refresh keeps it and can never widen it.

• Refresh tokens rotate. Keep the newest one and refresh one request at a time. Reusing an older, already-rotated token revokes that person's access for your client; they connect again through the browser.

• Revocation is supported for access and refresh tokens.