- Claude Code
- Claude.ai
- Cursor
- Other
1
Create a key
In the Ziplined app, go to Settings, Integrations, API keys. Create a key with
scope
read. It starts with zpl_ and is shown once.2
Add the server
3
Ask something
Try “who engaged with my posts last week that I have never messaged?”. See
First questions.
OAuth or an API key
OAuth or an API key
Use OAuth when a person connects their own assistant. The token carries who they are,
they get every scope their workspace allows, and there is no secret to lose.Use an API key when a program connects, or when the client cannot do the OAuth
handshake. The key carries fixed scopes, so a
read key sees seven of the ten tools. The
other three are absent from tools/list.Either way the workspace comes from the credential. In Claude.ai you can also pick
authentication static_headers with Authorization: Bearer zpl_.... That needs an org
admin, and the caller is then a key rather than a person.The 401 handshake points at /.well-known/oauth-protected-resource, which names Clerk as
the authorization server.Limits and errors
The REST API and MCP share one rate limit bucket per credential. A missing plan feature is
a 402 with an upgrade URL.
Which errors are tool errors
Which errors are tool errors
An error inside a tool is a tool error, not a transport error.
structuredContent carries
invalid_argument, forbidden, not_found, conflict, rate_limited (with
retry_after in seconds) or internal_error.Only missing or invalid authentication is an HTTP status. The client has to react to it
with an OAuth handshake, so it answers 401 with
WWW-Authenticate: Bearer resource_metadata="...".The full list of codes is on Errors.