IQRush MCP authentication and access management

IQRush MCP supports three authentication methods depending on your client. Device flow for locally installed connectors, OAuth 2.1 for remote clients, and API keys for manual or CI environments.

Device flow (Claude Desktop)

Used by clients running the local connector installed via the install script.

1. On first use, the connector prints a short URL to its logs:

2. Open the URL in your browser. A confirmation screen shows what access is being requested.
3. Click Allow access. Your token is saved locally — you won’t be prompted again.

Token lifetime: 90 days. After expiry, restart Claude Desktop and follow the sign-in link again.

OAuth 2.1 (Claude.ai, Claude Code, ChatGPT)

Used by remote clients connecting via the MCP URL.

1. Add the MCP URL in your client’s connector settings.

2. On first connect, a browser window opens to the IQRush sign-in screen.

3. Sign in and approve access. The client stores the token internally.

No API keys, client IDs, or secrets required. The client handles token refresh automatically.

API keys (manual setup or CI environments)

For scripted or automated environments where browser auth is not possible.

1. Go to Settings → Developers → API Keys in the IQRush app.

2. Click Create new key, give it a name, and copy it immediately — it is not shown again.

3. Pass it as the IQRUSH_TOKEN environment variable in your client configuration.

Keys are prefixed iqr_ so they’re easy to identify in config files.

What the connector can access

The connector can read:

• Your projects, measurement runs, and visibility data

• Your brand context (entity bundle and competitor bundles)

• Your GA4 properties (if connected)

The connector cannot:

• Create, modify, or delete projects or runs

• Change your brand context, topics, or settings

• Access other users’ workspaces

Revoking access

To revoke a token or API key, go to Settings → Developers → API Keys in the IQRush app. Deleting a key immediately revokes access for any client using it.

For OAuth clients (Claude.ai, Claude Code, ChatGPT), revoke access from within the client’s connector settings, or from IQRush Settings → Developers.

Frequently asked questions

How long does device flow authentication last?

Device flow tokens expire after 90 days. Restart Claude Desktop and follow the sign-in prompt to re-authenticate.

Can I use the same token on multiple devices?

Each install creates a separate token. If you install the connector on a second machine, you will be prompted to sign in again on that machine.

What should I do if I think my API key has been compromised?

Delete it immediately in Settings → Developers → API Keys and create a new one. There is no way to rotate a key — deletion is the only option.

Does revoking access affect my measurement data?

No. Revoking access only ends the connector’s ability to read your data. All measurement data, projects, and runs remain intact.