Authentication
Connect with OAuth as yourself, or use an org-scoped API key.
The MCP server accepts two credentials. OAuth is the recommended way to connect an agent as yourself. For server-to-server integrations, use the same API keys as the REST API. Every MCP request carries its credential as a bearer token.
OAuth (recommended)
Add https://mcp.raster.app/ as a remote MCP server in your client (Claude,
Cursor, or any client that speaks MCP authorization). The client discovers
the authorization server automatically, registers itself, and opens a Raster
consent page where you sign in and choose the organizations the connection
may access. When the client requests access to all your organizations, the
connection gets all of them by default, and you can narrow it to one. Any other
client gets the one organization you pick. The connection gets your library
access within those organizations and follows it live: when a role changes or a
library is removed, the connection changes with it.
Pick your client for a connect button or short setup steps:
Add a remote MCP server with this URL:
https://mcp.raster.app/Claude Desktop: Settings → Connectors → Add custom connector, then paste the URL.
Claude Code: Run claude mcp add --transport http raster with the URL.
Then approve the Raster sign-in and choose which organizations the connection may access.
To have your agent add it, paste this prompt:
Add the Raster MCP server to this client: a remote Streamable HTTP server named "raster" at https://mcp.raster.app/ over OAuth. Then walk me through the OAuth sign-in for this client (reload it if needed, approve in the browser) and confirm its tools load.
Manage every connection under Profile settings → Connected apps, where one click revokes it.
Setting an asset's approval with
set_asset_approval works only over an
OAuth connection; an API key can read approval but not set it.
No-account agent endpoint
Agents that have no Raster account yet connect to a separate endpoint:
https://mcp.raster.app/anonymousThis endpoint takes no credential. It serves the MCP handshake and one tool,
create_organization, which mints an
organization, a starter library, and an API key. The agent then connects to the
main endpoint https://mcp.raster.app/ with that key as a bearer token to upload
and manage assets, and the user claims the organization within 30 days via the
emailed link.
API keys
You manage keys in each organization's settings, where you can:
- Create a key when you need one.
- Scope it by enabling access only to specific libraries.
- Regenerate it if it is ever exposed.
- Delete it when it is no longer needed.
Creating a key
Open organization settings
Go to Organization name → Settings in the Raster app.
Generate a new key
In the API keys section, generate a new key and copy it. You can reveal and copy it again later from the same section.
Grant library access
Enable Read access for every library the key should reach. Add Write access if the connection will upload, delete, tag, or move assets. Save your changes.
Treat API keys like passwords. Never commit them to source control or expose them in client-side code. If a key leaks, regenerate it immediately. The old value stops working at once.
Access levels
Each key carries a per-library access level. Tools check this level before running:
| Level | Grants |
|---|---|
| Read | Read tools (list_libraries, list_assets, get_asset, search_assets, list_tags) and every resource. |
| Write | Write tools: create_library, rename_library, upload_asset, upload_assets, delete_assets, tag_assets, untag_assets, update_asset_description, transfer_assets, promote_variant. Includes read. |
A tool that targets a library your credential cannot reach fails with
API_KEY_NOT_AUTHORIZED_FOR_LIBRARY (404), the same response as an unknown
library. See Errors.
Authenticating the connection
Send your key as a bearer token in the Authorization header on every
request to https://mcp.raster.app/:
Authorization: Bearer <API_KEY>In MCP clients that support a custom Authorization header, you paste the key
once when adding the remote server and the client attaches it to every request.
Requirements
- Use HTTPS. Requests over plain HTTP are rejected.
- Authenticate every request. A missing or malformed
Authorizationheader is rejected with401before any tool runs. - Your credential must have the right access level for every library a tool touches.