FAQ
“client_disabled” after I signed in
Section titled ““client_disabled” after I signed in”The OAuth client isn’t recognized yet - a new client registers automatically but stays disabled until approved. Contact support with the client name and roughly when you tried to connect.
“invalid_scope”
Section titled ““invalid_scope””The client asked for a scope Dropslate doesn’t have. Only read, write and offline_access exist - this points at a bug or misconfiguration in the client, not something to change on your end.
I got a 401 with a resource_metadata link in WWW-Authenticate
Section titled “I got a 401 with a resource_metadata link in WWW-Authenticate”The token expired or was revoked. Your client should refresh it automatically; if it doesn’t, disconnect and reconnect.
I see fewer than 22 tools
Section titled “I see fewer than 22 tools”Call dropslate_whoami - it names the scopes on this credential and the workspace’s plan. A read-only key or token sees 11 tools; the Free plan sees 11 regardless of scope, because Free can read but not publish.
Can an agent see my API key or OAuth token?
Section titled “Can an agent see my API key or OAuth token?”No - a key lives in the client’s environment variables or credential store, never in a prompt or tool response; an OAuth token is held by the client application, not exposed to the model as text. If you ever see a real key or token appear in a chat message, treat that client as compromised and revoke the credential immediately from Settings → API keys or Settings → MCP.
Does connecting an agent give it access to my email, billing or other members?
Section titled “Does connecting an agent give it access to my email, billing or other members?”No. There is no tool for members, billing, or connecting/disconnecting accounts, at any scope - see Safety rules.
Why doesn’t Cursor offer the remote sign-in option?
Section titled “Why doesn’t Cursor offer the remote sign-in option?”Its redirect URI has an authority component, which RFC 8252 says a native app’s redirect URI shouldn’t have - see Connect Cursor.
Can I use MCP and the REST API with the same key?
Section titled “Can I use MCP and the REST API with the same key?”Yes - MCP is a wrapper over the same /v1 routes, so a key’s scopes, plan and quotas apply identically either way. See API reference → Authentication.