> ## Documentation Index
> Fetch the complete documentation index at: https://docs.keystoneb2b.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & security

> How Keystone MCP authenticates users and what a connection can access.

<Note>
  **Who this is for:** Brand administrators evaluating MCP, and integrators wiring MCP clients. End users mostly just complete the Keystone app consent screen.
</Note>

Keystone MCP uses **OAuth 2.1 with PKCE** (the standard for remote MCP servers). Your AI client never stores your Keystone password. The AI client opens Keystone's authorization URL; Keystone redirects you into the **Keystone app** so you sign in with the normal stack (email/password, SSO, MFA when enabled), then consent. After you allow access, the app mints an authorization code for the AI client.

## Who can connect

| Requirement        | Detail                                                                                      |
| ------------------ | ------------------------------------------------------------------------------------------- |
| Plan               | **Pro** or **Enterprise**. Basic brands use Gus in-app only.                                |
| Role               | **Brand** or **rep** only. Buyer (account) users are rejected.                              |
| Brand opt-in       | `mcp_enabled` must be on for the tenant ([Platform Settings](/settings/platform-settings)). |
| Soft-deleted users | Treated as signed out — cannot connect.                                                     |

## Scope

Connections receive a single scope:

| Scope           | Meaning                                                                                                  |
| --------------- | -------------------------------------------------------------------------------------------------------- |
| `keystone:read` | Run Gus's **read-only** data tools under your permissions. No writes, no order placement, no email send. |

## What the AI can see

Every tool call runs as **you**:

* Postgres Row Level Security (tenant, role, partner assignment) applies the same way as in the Keystone app and Gus.
* Reps only see their assigned accounts; brand users see brand-wide data according to their role.
* Keystone does **not** give the AI a service-role or admin key.

## Managing sessions

* Open **Settings → MCP connections** to list active AI clients and **Revoke** any of them.
* AI clients that support RFC 7009 can also call the MCP revocation endpoint.
* Turn off **Enable MCP (AI clients)** in Platform Settings, or drop to Basic, to stop MCP data access for the brand — new logins are blocked and existing sessions fail on the next data tool call.

## Privacy note

Tool results leave Keystone and are processed by the AI vendor you chose (Anthropic, OpenAI, etc.). Use the same judgment you would when pasting Keystone data into that product's chat window.

## Related

* [Overview](/mcp/overview)
* [Connecting clients](/mcp/connecting-clients)
* [Tool reference](/mcp/tool-reference)
* [AI Assistant (Gus)](/features/ai-assistant)