Skip to main content
Every app credential you connect to an MCP Gateway or Deployment (Slack, GitHub, Salesforce, and so on) has an access level: Personal or Tenant. This controls who the connection belongs to and who can use it, separate from the visibility setting on the Gateway itself. The access level for a credential is only modifyable for API keys.

​
The Two Levels

LevelWho can use itTypical use case
PersonalOnly youYour own accounts, individual API keys, anything tied to your identity
TenantEveryone in your organizationShared service accounts, a single organization-wide API key, apps everyone should access the same way
Personal is the default for a new connection. An admin has to explicitly share a configuration at the Tenant level.

​
How Each Authentication Method Handles Levels

Access levels don’t work identically across every authentication method. What’s actually shared at the Tenant level depends on how the app authenticates.
Authentication MethodWhat can be shared at Tenant levelWhat always stays Personal
OAuth (DCR)Nothing, always PersonalYour sign-in and access token
OAuth (Manual)The OAuth app registration itselfEach user’s individual sign-in and access token
API KeyA single organization-wide keyIndividual keys if no tenant level key has been provided by an admin.
Pass-ThroughNot applicableNot applicable, since nothing is stored
OAuth sign-ins and tokens are always personal to the user who authenticated, even though the underlying app registration is shared at the Tenant level. One person’s login is never used on another person’s behalf.
Some apps support one-click OAuth where you just click Connect and authenticate immediately. For these, there’s no admin setup step and no level to choose, your connection is Personal by definition. Other apps require an admin to register an OAuth app first (providing a client ID and secret, for example). That registration is created at the Tenant level so it only has to be done once, but each person in your organization still has to click Connect and sign in with their own account. Nobody’s access is shared just because the app registration is. For API key based apps, an admin gets an explicit choice:
  • Share across tenant: Enter one key that every user in the organization will use.
  • Leave it personal: Each user provides their own key when they connect.

​
Choosing a Level

Choose Tenant when…Choose Personal when…
The app represents a shared resource (a team Slack workspace, a shared database)The app is tied to an individual’s identity or permissions
You want every user to have access without individually connectingDifferent users should have different levels of access to the underlying app
You’re managing a service account or bot credentialYou want to audit actions back to a specific person

​
Managing Access

Who can create, change, or remove a connection depends on its level and your role:
  • Tenant-level connections can only be created, changed, or removed by an admin (Platform Admin, Admin, or a custom role with the appropriate permission). Any user in the organization can use one once it exists.
  • Personal-level connections can only be seen and managed by the user who created them. Not even an admin can see or use another user’s personal connection.
Removing your own personal connection or disconnecting your account never affects the underlying Tenant-level app registration. It stays in place for everyone else.

​
Changing an Existing Connection’s Level

You can move an API key between levels after it’s created, with a few guardrails:
  • Promoting Personal to Tenant makes the connection available to everyone in your organization going forward.
  • Demoting Tenant to Personal removes access for every other user who was relying on it. You’ll be warned before this happens, since it can break any Gateway or Deployment that depended on the shared connection.