Skip to main content
When you connect an AI client to the MCP server by signing in, the approval you give creates a connection: one application, one organisation, one set of scopes. Everything about connecting your assistant is on one page: Settings → Your assistant, at app.attensira.com/settings/access. It has the steps for your assistant, the Connected clients section that explains what a connection can reach and how to take it away, and your API keys. Static atn_live_ keys are not connections; they are minted and revoked in the same place. See API keys.

​
GitHub is not on this list

GitHub is a first-party GitHub App that you install into your organisation or account. It is not an OAuth connection and it is not brokered through a third-party connector, so it does not appear on this page and cannot be revoked from it. Manage it from the project’s GitHub settings, or from GitHub’s own installation page. Disconnecting an AI client here has no effect on the App, and uninstalling the App has no effect on anything here. Google Ads is connected as a connector on the workspace, where you also choose which Google Ads account it uses. It is not an AI-client connection, so it does not appear here, and disconnecting a client here does not disconnect it. A connection here never reaches your ad budget. Even with Read and write, an AI client cannot approve a Google Ads change that spends money or cannot be undone: that yes is given only by a person signed in to the Attensira app, and a client asking gets 403 Forbidden with the reason spend_approval_in_app. See Approval modes.

​
What a connection can reach

A connection names your organisation, not a single workspace. Every MCP tool that works on a workspace takes an optional project, so one connection reaches every workspace the organisation owns — you do not connect a client once per domain. Omit it and your only workspace is used; when the organisation has several, there is no default and the client names one. get_account lists the ids, and answers without a workspace. A connection always carries read and write: there is no read-only consent, and write is the one that spends credits. Where you need a credential that cannot write, mint a read-only API key instead.
Anyone can register a client and choose its display name. Nothing stops someone registering one called “Attensira Sync” and hoping the name is enough. Read the name and the requested scopes on the approval screen, and be sure about anything unfamiliar asking for write access.

​
Disconnecting

Remove the server in the client that holds it. In Claude Code that is claude mcp remove attensira; in Cursor or Codex it is the entry you pasted into the config file. That stops the client asking for anything further.
An access token the client already holds keeps working until it expires, because the MCP server verifies tokens locally and never asks us whether one is still wanted.If you need access cut off now rather than at the next expiry, use a key rather than a sign-in: a key is revoked from Settings → Your assistant and stops working on the very next request. See API keys. If a signed-in client may be compromised, contact team@attensira.com to have it cut off.
Disconnect when a laptop is lost or decommissioned, when someone leaves, or when you were testing a client you no longer use. Reconnecting takes one browser prompt, so disconnecting first and asking later is the cheap direction.

​
Reading the wrong workspace

Approving a client fixes the organisation, never a workspace. If a client is reading the wrong workspace, ask it to name the right one rather than reconnecting — every tool takes an optional project, and get_account lists the ids. The organisation cannot be moved afterwards. To reach a different one, disconnect and sign in again.

​
Seeing what a client did

Anything a connected client files in your workspace is marked with its name, such as via Claude, and the Inbox gathers those rows under From your assistant. An approval it makes is recorded the same way in the item’s history. The name is what the client calls itself, so it is a label and grants nothing. See how your assistant’s work is marked.

​
Reconnecting

Connections do not last forever on their own. Access tokens are short-lived and the client refreshes them quietly; eventually the refresh runs out and the client asks you to sign in again. That is normal, takes one browser prompt, and nothing is lost — no configuration changes and no data goes away. If a client asks for consent far more often than that, it is not storing the refresh token it was given. See MCP troubleshooting. Next: OAuth reference for what happens underneath, or Connect a client to add another one.