Authentication and keys

AI clients and integrations reach a Fieldproxy workspace through the MCP server, signed in with OAuth or a scoped key. Access is off until an administrator switches it on, and it never exceeds what the signed-in person can see.

Switch it on

AI assistant access is off by default. An administrator switches it on for the workspace, and optionally switches on Allow build, which lets administrators' AI clients change the software itself.

The MCP address

The MCP server is regional: https://<api-host>/mcp. For example https://api-india-1.fieldproxy.ai/mcp (India) and https://api-us-east-1.fieldproxy.ai/mcp(US East). Your workspace's address is shown in Settings, AI assistant when you create a key. The examples on these pages use the India host; swap in yours.

Option 1: OAuth sign-in

Claude (custom connector), ChatGPT (developer-mode app) and Copilot Studio connect with OAuth: the person signs in with their workspace ID, email and password and ticks the scopes the client may use. ChatGPT uses OAuth with dynamic client registration; Copilot Studio uses OAuth 2.0 with dynamic discovery. The sign-in token lasts 1 hour and renews itself for 30 days.

Option 2: a scoped key

Make a key in the web app under Settings, AI assistant, New key. Keys start with fpmcp. and are shown once, so store them in a secret manager. Send the key on every request:

header

Authorization: Bearer fpmcp.YOUR_KEY

Claude Code

claude mcp add --transport http fieldproxy https://api-india-1.fieldproxy.ai/mcp \
  --header "Authorization: Bearer fpmcp.YOUR_KEY"

OpenAI Codex

export FIELDPROXY_MCP_KEY=fpmcp.YOUR_KEY
codex mcp add fieldproxy --url https://api-india-1.fieldproxy.ai/mcp --bearer-token-env-var FIELDPROXY_MCP_KEY

any MCP client (url + headers)

{
  "mcpServers": {
    "fieldproxy": {
      "url": "https://api-india-1.fieldproxy.ai/mcp",
      "headers": { "Authorization": "Bearer fpmcp.YOUR_KEY" }
    }
  }
}

Scopes

Scope	Requires	Unlocks
`data:read`	AI assistant access on, and the person has Command Center access	The schema, ready-made reports and read-only SQL on the workspace's own data
`data:write`	Tables the workspace lets the AI write, with no approval gate on them	Record changes confirmed by a person and undoable; email and SMS drafts sent on confirm
`build`	An administrator, plus Allow build switched on	New fields, tables, screens, automations, voice and text agents, and sandboxes

Limiting a key

Tables: only the tables you list.
Rows: a row filter such as only one region's jobs, enforced by Postgres.
Columns: hidden columns are removed from every result, however the query asks for them.
Operations: insert, update and delete, each allowed or not.
Expiry: from 1 hour to 90 days.

Revoking and auditing

Every request is checked from scratch: the key is looked up each time, so a revoked or expired key is refused on the very next request. Administrators see every key and OAuth-connected app (list_ai_connections), revoke any of them (revoke_ai_access), and read the log of every tool call with key, person, tool and outcome (ai_activity_log).

Other APIs

The REST API uses its own keys, created under Settings, Security, API keys and sent in the x-api-key header. Inbound automation webhooks need no sign-in, only the rule's optional shared secret in the x-automation-secret header. The automation and public-forms staff APIs take a signed-in administrator session.

Checked against the Fieldproxy platform reference on October 18, 2026.

Get your own custom field service management within a day. Tailored to your workflows.

We set up a workspace on your own data and connect your AI or your systems on the call.

Get Demo