Authentication

Every request to the MCP server carries a bearer token in the Authorization header. There are two kinds:

	OAuth	Workspace token
For	Claude, ChatGPT	Claude Code, Codex, Cursor, VS Code, scripts
Set up	Sign in to Sublim and approve, from the assistant	Create it in Workspace settings → MCP, paste it in the client
Sees	The projects your Sublim account can access	The projects selected on the token, in one workspace
Lifetime	Renewed automatically while in use	Until revoked
Revoke	Remove the connector in the assistant	Workspace settings → MCP

Both are read-only: no tool can modify your data, whatever the token.

OAuth

Claude and ChatGPT use OAuth 2.1 with PKCE. When you add the connector:

The assistant opens a Sublim page. Sign in if needed.
Sublim shows the assistant's name and the access it asks for. Click Allow.
The assistant receives an access token, valid 7 days, and a refresh token, renewed on each use, to stay connected without asking again.

The client ID is entered by hand when you add the connector: claude-ai for Claude, chatgpt for ChatGPT, with no secret. See Connect your AI.

Scope	Grants
`profile`	Your name and email, so the assistant knows who is connected.
`projects.read`	Read access to the projects you are a member of. Required by the MCP server.

Same access as you

An OAuth connection acts as you. It sees exactly the projects you see in Sublim. If you lose access to a project, the assistant does too.

Workspace tokens

Workspace tokens are for tools that take a token in their configuration rather than signing you in.

Create one

In Sublim, open Workspace settings → MCP.
Click New token, give it a name (for example Cursor – Jane), and choose its projects:
- pick specific projects: only those;
- or switch on All projects: every project of the workspace, including the ones created later.
Click Create token, then copy it. It looks like sblm_mcp_3f9a… and is shown only once: Sublim stores only a hash of it.

The page also gives ready-to-paste commands for Claude Code and Codex.

Use it

Send it as a bearer token:

HTTP

POST /mcp HTTP/1.1
Host: mcp.sublimanalytics.com
Authorization: Bearer sblm_mcp_YOUR_TOKEN
Content-Type: application/json
Accept: application/json, text/event-stream

list_projects returns only the token's projects. Asking for another project returns an error telling the assistant to pick one from list_projects.

Revoke it

Revoke a token in Workspace settings → MCP. It stops working within 5 minutes. The list also shows when each token was last used, which helps spot the ones you no longer need.

Treat it like a password

Anyone with the token can read its projects' analytics. Prefer one token per person and per tool, limit it to the projects needed, keep it out of version control, and revoke it when it is no longer used.

Errors

Response	Meaning
`401` with `WWW-Authenticate: Bearer resource_metadata=…`	Missing, expired or revoked token. OAuth clients use the metadata URL to sign in again.
Tool error "This MCP token does not grant access to project …"	The project isn't in the token's selection.
`405` on `GET /mcp`	The server only accepts `POST` (streamable HTTP without SSE).

Discovery endpoints

OAuth clients find the authorization server on their own, through these standard metadata documents:

URL	Standard
`https://mcp.sublimanalytics.com/.well-known/oauth-protected-resource`	Protected resource metadata (RFC 9728)
`https://api.sublimanalytics.com/.well-known/oauth-authorization-server`	Authorization server metadata (RFC 8414)