Static credentials
Generate a client ID and secret for MCP clients that need a pre-registered OAuth client instead of registering themselves.
Most assistants, Microsoft Copilot Studio included, register themselves with Suede when you add the server URL — see Connect an AI assistant. A few clients can't: they ask you for a client ID and secret instead. For these, an Owner or Admin generates static credentials to paste into the client's configuration. You still sign in to Suede once when the client first connects.
Only Owners and Admins can create or revoke static credentials. If you're a Member or Viewer, ask an organization Admin to provision them for you.
Before you begin
-
The Owner or Admin role on the workspace.
-
The server URL, which the client also needs:
https://mcp.suedewebsystems.ai/mcp/v1
Generate a credential
Open Workspace MCP Management
Open your workspace settings and go to MCP Management. This page governs every static credential in the workspace.
Start a new connection
Select New connection to open the credential form.
Fill in the details
- Label — A name to recognize this credential later (e.g., "Reporting connector – Marketing"). Only you see it; it isn't sent to the client.
- Scopes — What the credential is allowed to do. Grant the least it needs:
data:readfor read-only, adddata:writeto let it edit monitoring data. See Tools and permissions reference. - Redirect URI — The OAuth callback URL your client shows when you configure it. Paste it exactly: Suede only sends sign-ins back to this address.
Generate
Select Generate connection. Suede shows the client ID and client secret.
Copy the client secret now — it is shown only once. Suede stores it hashed and can never display it again. If you lose it, revoke the credential and generate a new one.
Connect the client
In your client's OAuth settings, enter the server URL, the client ID, and the client secret. The first time it connects, sign in to Suede to authorize it. From then on it can use whatever the credential's scopes allow.
Govern credentials
Workspace MCP Management lists every static credential in the workspace, including ones created by other Admins, with who created each. Any Admin or Owner can revoke any credential.
Revoking is immediate and permanent: it invalidates every token ever issued from that credential. A client using it loses access at once. To rotate a credential, generate a new one first, update the client, then revoke the old one.
Audit member connections
The same page shows an audit of the assistants your members have connected by signing in (see Connect an AI assistant) — the member, the assistant, the access granted, and when it was last active.
This view is read-only. Sign-in connections are personal, so only the member who created one can disconnect it. To cut off a member's access, ask them to disconnect, or remove them from the organization.
Owners and Admins can also generate static credentials for their own use from My MCP Connections → Your static credentials in the account menu. Workspace MCP Management is the place to see and govern all of them together.