# Authentication

> Connect Lexsis Storefront MCP through browser OAuth

Canonical URL: https://fa7e86e3d553:3005/getting-started/authentication

## Browser OAuth

Lexsis Storefront MCP uses browser OAuth for every hosted user connection. You
do not need to create, copy, or paste a Lexsis API key.

## Connect in three steps

### 1. Install the MCP

Run the installer and select the AI clients you want to configure:

```bash
curl -fsSL https://mcp.trylexsis.com/install.sh -o /tmp/lexsis-install.sh && sh /tmp/lexsis-install.sh
```

The installer supports Codex, Claude Code, Cursor, and Claude Desktop. It adds
the hosted `https://mcp.trylexsis.com/mcp` endpoint and installs the Lexsis
skills where the client supports them.

### 2. Restart your AI client

Close and reopen the client so it discovers the new MCP server. The first
Lexsis connection starts browser authorization automatically.

### 3. Authorize in your browser

Sign in to Lexsis, select the workspaces the client may access, and choose a
permission level:

| Permission | Allowed operations |
|------------|--------------------|
| Read | Inspect workspaces, products, pages, analytics, and documentation |
| Build | Read access plus draft creation, edits, uploads, and generation |
| Publish | Build access plus publishing, deletion, rollback, and live experiment operations |

The client receives short-lived OAuth tokens. User API keys are not accepted by
the MCP endpoint and are never copied into the project or exposed to the MCP
client. You can review or revoke the connection from **Account → Connected
Apps**.

## Manual Configuration

For an MCP client the installer does not support, add the hosted server:

```json
{
  "mcpServers": {
    "lexsis-ai": {
      "type": "http",
      "url": "https://mcp.trylexsis.com/mcp"
    }
  }
}
```

Restart the client and complete OAuth when prompted. The MCP server handles
workspace resolution, store targeting, and permissions automatically. Access
can be revoked later from **Account → Connected Apps**.

Do not add an `Authorization` header or an API key to this configuration. The
AI client owns the OAuth access and refresh tokens.

The default `/mcp` endpoint exposes the consolidated tool surface. Existing
one-tool-per-operation integrations must migrate to the consolidated action
routers. `/mcp/legacy` is retired and returns HTTP 410.

## Reconnecting an older setup

Remove the old Lexsis MCP entry, add the hosted server again, restart the
client, and complete browser authorization. The hosted MCP rejects copied `lx_`
API keys and other manually configured bearer credentials.

## Troubleshooting

| Issue | Fix |
|-------|-----|
| "Unauthorized" on tool call | Reconnect the MCP and complete browser OAuth again |
| "Insufficient scope" on a write or publish action | Reauthorize with Build or Publish access |
| Workspace missing from the consent page | Confirm your Lexsis account still has access to it |
| Tools not appearing | Restart your MCP client after adding the server config |
| Client still asks for an API key | Remove its old Lexsis entry and reconnect to `https://mcp.trylexsis.com/mcp` |

## Related

- [Quickstart](/getting-started/quickstart) — Build your first page
- [Skill packs](/getting-started/skill-packs) — Install Lexsis workflows for supported clients