Appa Tools documentation for MCP Studio, including setup, guides, concepts, and API-related reference content.

Skip to main content

Sign in and get credentials

Use SDK credentials to authenticate your embedded MCP Studio experience and server-to-server API calls.

AudienceDevelopers and platform admins setting up MCP Studio SDK
PrerequisitesGitHub or Google account and access to the SDK portal

Create your developer account​

To access the developer portal and manage your SDK configuration, sign in with either GitHub or Google at the sign-in page.

When you sign in for the first time, a developer account is automatically created with a unique Client ID and Client Secret.

Credentials​

After signing in, you'll see your credentials in the developer portal:

  • Client ID — A public identifier for your integration. This is included in the embed snippet and is safe to expose in client-side code.
  • Client Secret — A private key used for server-to-server API calls. Never expose this in client-side code or public repositories.

Regenerate your secret​

If your Client Secret is compromised, regenerate it from the developer portal. Click Regenerate on the credentials card. The old secret is immediately invalidated.

warning

Regenerating your secret will invalidate all existing server-to-server API calls using the old secret. Update your environment variables immediately after regenerating.

Security best practices​

  • Client ID is public: You can include it in frontend code.
  • Client Secret is private: Use it only in server-side code or environment variables.
  • Custom domains: If you configure a custom domain, requests from other origins are rejected.
  • Secret rotation: If you suspect a compromise, regenerate the secret immediately from the portal.