WEBVTT

1
00:00:00.000 --> 00:00:12.720
Rail Cove has three different kinds of connection. Server provider keys stay in the private environment, personal keys call approved API scopes, and MCP apps connect through OAuth.

2
00:00:13.000 --> 00:00:25.440
When a direct API client needs access, create a named personal key with only the scopes it needs. Copy it once, store it in a secret manager, and never place it in browser code.

3
00:00:29.000 --> 00:00:38.120
For MCP, let the client open Rail Cove's consent screen. Check the application name and requested scopes before you allow access.

4
00:00:43.000 --> 00:00:56.280
Return to Settings and Connections to review access. Revoke the key or MCP application when you no longer use it; the connection stops without changing your ordinary sign-in session.