Authentication

Every request to the MCP server must carry a credential in the Authorization header. There are two kinds:

	Sign in with Estel (OAuth 2.1)	API key
Best for	Claude, Cursor, VS Code, Claude Code and other interactive apps	Scripts, CI, servers, clients without sign-in
How you get it	The app opens Estel and you approve it	Create one in Settings → API & MCP
Lifetime	Renewed automatically. Lapses after 30 days without use	Never, 30 days, 90 days or 1 year, as you choose
Revoke from	Settings → API & MCP → Connected apps	Settings → API & MCP → API keys

Either way, the credential acts as you. Calls use your daily quotas and your enrichment credits, and they work only while your plan includes MCP access.

Scopes

Scope	Allows
data:read	Search leads, companies, signals and market insights. Always included.
leads:enrich	Enrich leads using your account's lead credits.

A credential without leads:enrich can explore everything but can't spend credits. Calls to enrich_lead then fail with insufficient_scope.

How sign-in works

The server follows the MCP authorization specification, so MCP clients handle these steps for you:

1. The client calls /mcp without a token and receives 401 with a WWW-Authenticate header that points to the protected resource metadata.
2. The client reads the metadata, registers itself (dynamic client registration) and starts an authorization code flow with PKCE (S256).
3. Your browser opens the Estel consent page. Sign in, check the app's name, where you'll be sent back to and the permissions it asks for, then approve or deny.
4. The client exchanges the code for an access token and a refresh token.

An app that doesn't ask for particular scopes asks for both, so it can enrich leads. If you want an assistant that can only explore, use a read-only API key.

Tokens

• Access tokens last 1 hour.
• Refresh tokens last 30 days and rotate on every use. The client receives a new refresh token each time it renews.
• Reusing an old refresh token, or reusing an authorization code, revokes the whole connection. Clients that renew normally never notice. A stolen copy stops working.
• Tokens are bound to https://mcp.estel.tech/mcp and are not accepted anywhere else.

Endpoints

Clients discover these automatically. They're listed here for client developers.

	URL
Issuer	https://mcp.estel.tech
Protected resource metadata	https://mcp.estel.tech/.well-known/oauth-protected-resource/mcp
Authorization server metadata	https://mcp.estel.tech/.well-known/oauth-authorization-server
Authorization	https://mcp.estel.tech/authorize
Token	https://mcp.estel.tech/token
Dynamic client registration	https://mcp.estel.tech/register
Revocation	https://mcp.estel.tech/revoke

Supported:

• Grant types: authorization_code and refresh_token.

• PKCE: S256 only.

• Responses: authorization responses include iss (RFC 9207).

• Redirect URIs:

  • https URLs
  • http on localhost, 127.0.0.1 or [::1], for native apps
  • private-use app schemes such as cursor://

  URIs with fragments, embedded credentials, or schemes like javascript: and file: are rejected.

Disconnecting an app

In the Estel app, open Settings → API & MCP → Connected apps and choose Disconnect. This revokes the app's tokens. Apps can also revoke their own tokens at the revocation endpoint.

API keys

Create a key

1. In the Estel app, open Settings → API & MCP.
2. Give the key a name that says where it will be used, for example Cursor on my laptop or ci-reporting.
3. Pick when it expires: never, 30 days, 90 days or 1 year.
4. Leave Allow enriching leads ticked to let the key spend credits (leads:enrich), or untick it for a read-only key.
5. Choose Create key and copy the key. It's shown once. Estel stores only a hash, so a lost key can't be recovered. Revoke it and create a new one.

Keys start with est_live_. You can have up to 10 active keys.

Use a key

Send the key as a bearer token in the Authorization header:

Authorization: Bearer est_live_...

Keys are accepted only in the header, never in a URL or query string. See Connect a client for client-specific examples.

Revoke a key

Open Settings → API & MCP, find the key and choose Revoke. A revoked key stops working within 30 seconds. The list shows when each key was last used, which helps you spot keys you no longer need.

Keep keys safe

• Store keys in a secret manager or an environment variable. Never put them in code, config files you commit, or URLs.
• Use one key per integration, so you can revoke one without breaking the others.
• Give keys only the access they need. Untick Allow enriching leads for automations that only explore.
• Set an expiry for keys used by scripts and CI.
• If a key may have leaked, revoke it straight away.

When access stops

Credentials stop working, with a not_entitled error that explains why, when:

• the subscription is cancelled and its paid period has ended,
• the subscription is no longer active,
• the account moves to a plan without MCP access.

Plan changes apply within a minute. Your keys and connections stay listed in Settings and work again when the plan is renewed.