Advanced mode — users & companies

Grow beyond one shared API key

Your AI workflows can grow across people, client accounts and companies. Advanced mode lets you reuse an API integration while choosing exactly which saved connections each MCP access profile may use.

A profile is a named MCP access key, such as Maria · Company A. It is not a new PipMCP dashboard login. Anyone holding that key can use its permitted tools, so share it only with its intended user or AI client.

Example: one finance system, three companies

Save three connections to the same finance integration:

Connection	Credentials used	Access profile
Finance · Company A	Company A’s API key	Maria · Company A
Finance · Company B	Company B’s API key	Maria · Company B
Finance · Company C	Company C’s API key	Maria · Company C

All three profiles can use the same MCP endpoint URL, but each has a different MCP access key. A call made with Maria’s Company B profile uses Company B’s connection. It does not switch to Company A or C based on what the AI asks.

For someone who works across several companies, create one profile per company. Configure them as separately named server connections in an AI client that supports multiple connections, or switch the configured profile before working on another company. There is no company-selector argument that lets the AI override the profile.

Set it up

1. Open Connections and save a connection for each company. Give each a clear company name and enter that company’s API credentials. You can also follow Add a company connection in the advanced form.
2. Open MCP endpoints and choose the endpoint linked to your finance integration.
3. Find Advanced mode · Users & companies. Enter a profile name and an expiry period.
4. For each API, choose the connection that this profile should use. Leave APIs set to No access if they should be unavailable. Select at least one connection.
5. Click Create profile & access key. Copy the key immediately: PipMCP shows it once.
6. Configure the AI client with the endpoint’s server URL and this key as its Bearer token. If the client accepts a personal URL instead, append /YOUR_MCP_ACCESS_KEY to the endpoint URL. Treat that entire URL as a secret.
7. In Connection links, choose an existing permission role if you need to further limit the profile’s tools. Endpoint policies still apply.

Never paste a finance system’s API key into the MCP client. Save upstream credentials in the company connection; give the AI client only its PipMCP access key.

What stays separate

• Credentials: every profile has an explicit connection choice for each permitted API.
• Company context: connection-specific fixed inputs, such as an organisation ID, come from the chosen connection.
• Access: APIs without a connection in the profile are unavailable. Adding another API to the endpoint does not automatically grant it to existing advanced profiles.
• Revocation: switch off one profile in Connection links without revoking other profiles.
• Execution records: PipMCP records the MCP token and the connection used for each execution. Credentials are not included in the profile list.

A profile selects one connection per API. It may combine different APIs—for example, Company A’s finance connection and its CRM connection. Create another profile to use Company B’s credentials for that same finance API.

Safe failure and credential changes

If a selected connection is disabled or deleted, its tools become unavailable to that profile. PipMCP does not substitute the endpoint’s default connection. Expired or revoked MCP keys cannot authenticate.

Profile connection choices cannot be reassigned in place. To move a person to another company, create a new profile, configure the new access key, and revoke the old one. This avoids changing the company behind an existing access key. You can rotate an upstream API key within the same company connection without replacing every profile that uses it.

Shared connections remain shared: changing or disabling a saved connection affects all profiles assigned to it. Keep company connections clearly named, and keep the company identity unchanged when rotating credentials.

Choose the right setup

Need	Setup
One company and a common set of credentials	Existing shared endpoint links
Different staff using different company credentials	Advanced profile for each person/company
One finance team managing several companies	Separate company connections and clearly named profiles
Fewer tools for a profile	Assign a permission role and review endpoint safety settings
Help designing a rollout for clients or departments	Talk to us

Ready to roll this out across your finance team or client portfolio? contact the PipMCP team.