Authentication

OAuth for your account. API keys for calculations.

Human Design MCP deliberately supports two credential types with different authority. Choose OAuth for private HumanDesign.ai account tools; choose an API key for the original calculation/reference surface.

HumanDesign.ai OAuth

Add https://mcp.humandesign.ai/ as a remote Streamable HTTP MCP server without a static authorization header.
Use the client's Authenticate, Connect, /mcp, or MCP login action.
Sign in on the branded HumanDesign.ai page and review the selected account boundary and available capabilities.
Reconnect after a membership, workspace role, entitlement, or authorization change.

OAuth access is always intersected with membership and ownership. Free and Individual accounts can create, save, view, and render their own primary chart; Individual also includes account-usage visibility. Personal or Pro is required for other people's authorized charts and wider platform features.

API-key calculation access

Bearer API keys and X-Api-Key remain supported for the six calculation/reference tools. They do not expose account, library, report, or Builder data.

Authorization: Bearer $HDAI_API_KEY
# or
X-Api-Key: $HDAI_API_KEY

Credential safety

OAuth tokens are handled by the MCP client and authorization service; never paste them into prompts or source files.
Store API keys in an environment variable or protected secret store.
Never log authorization headers, refresh tokens, API keys, signed asset URLs, or structured private chart results.
Disconnect the connector or clear MCP authentication to revoke delegated access.
Manage API keys and calculation-plan usage at my.humandesign.ai.

Authentication errors

Code	Meaning	Action
`401`	Missing, malformed, expired, or revoked credential	Run the client's OAuth login again or restore the protected API-key setting.
`403`	Origin, capability grant, membership, role, ownership, or entitlement denied	Review the account boundary; reconnect after an approved access change.
`429`	Calculation quota or a safety rate limit was reached	Review usage; do not retry rapidly.