# QueryPanel authentication

QueryPanel uses separate authentication flows for its public MCP server and embedded analytics SDKs.

## MCP server

- Endpoint: https://mcp.querypanel.io/mcp
- Transport: Streamable HTTP
- Authentication: OAuth 2.0 access token issued by QueryPanel's Supabase authorization server

MCP clients should follow the OAuth Protected Resource Metadata advertised by the server after an unauthenticated request. Do not send database credentials, private SDK keys, or tenant identifiers in browser-controlled parameters.

### Connect from Claude, Cursor, or Grok Bot

1. Add `https://mcp.querypanel.io/mcp` as a Streamable HTTP MCP server, or install the official QueryPanel Cursor Marketplace plugin.
2. Choose **Connect** when the client prompts for OAuth.
3. Sign in to QueryPanel and approve access to the workspace you intend to use.
4. Start with `list_datasources`, then use `search_schema`, `generate_sql`, and `execute_sql` for a selected datasource.

The server takes the organization from the validated OAuth token. It does not accept a static API token, database password, private SDK key, or tenant identifier in the connection configuration.

For marketplace installation and example prompts, see https://github.com/querypanel/querypanel-mono/tree/main/mcp/marketplace. For help, contact csaba.ivancza@querypanel.io.

## Embedded analytics

Customer backends mint short-lived, tenant-scoped RS256 JWTs for the React SDK. The backend, not the browser, establishes tenant identity.

- React embed guide: https://querypanel.io/docs/react-embed
- Tenant isolation guide: https://querypanel.io/docs/tenant-isolation
- Node SDK guide: https://querypanel.io/docs/node-sdk