Most people connect Kickbite directly inside Claude or ChatGPT (see How to use Kickbite in Claude and ChatGPT). This guide is for a different setup: connecting the Kickbite MCP through an MCP gateway or aggregator — a platform that speaks MCP + OAuth to upstream servers and re-exposes their tools behind a single endpoint with its own access controls. If you're an individual user, you don't need this article.
How authentication works
The Kickbite MCP does not use API keys. It authenticates with a Kickbite account using standard OAuth 2.1 (authorization code + PKCE) — an interactive login. There is no static API key or client-credentials (machine-to-machine, no-login) option.
MCP endpoint:
https://mcp.kickbite.io/mcp(Streamable HTTP)Auth: OAuth 2.1 authorization code + PKCE, backed by a Kickbite account's login
Tokens: a short-lived access token (~2 hours) plus a refresh token (~1 week); your gateway should store them encrypted and refresh automatically
Step 1 — Register your gateway (client registration)
The server supports Dynamic Client Registration (RFC 7591). For security, the registration endpoint enforces a redirect URI allowlist: HTTPS only, exact host match, no wildcards. Claude and ChatGPT are pre-allowlisted.
To register your own gateway, your OAuth callback (redirect) URI host must be added to that allowlist. Send your exact callback URI(s) to your Kickbite contact — for example:
https://your-gateway.example.com/connections/callback
Once your host is allowlisted, your gateway can self-register via DCR and complete the standard authorization-code + PKCE flow. (You register as a public client with PKCE — no client secret is required.)
Step 2 — Create a dedicated, scoped Kickbite user
Rather than using a personal login, create a dedicated Kickbite user for the gateway and scope it to only the data it should access. This is done in Kickbite's own user management, so you stay in full control:
Create a user (a service account) in your Kickbite account.
Assign only the markets that gateway should see — not company-wide access.
Use a read-only role if the integration is analytics-only, so it can't change targets or segments.
Use a strong, unique password and rotate it when handing it to the gateway.
Because this is one shared account, all gateway activity appears under that single identity (no per-user attribution) — which is normal for a gateway integration.
Step 3 — Connect
Point your gateway at https://mcp.kickbite.io/mcp and complete the interactive OAuth login using the dedicated user from Step 2. The gateway's token then resolves only to that user's markets. Your gateway's own access controls (RBAC) sit in front, and the Kickbite tools are re-exposed to your users through your endpoint.
What you get
The same Kickbite MCP tools available in any client: marketing-channel and campaign breakdowns, product and ad-creative performance, customer-journey paths, cohort retention, and monthly target planning (a safe, preview-first write flow). All figures match the Kickbite dashboards.
Good to know
No static API keys. The login is always interactive OAuth 2.1; there is no client-credentials grant today.
Scope with the account, not the API. What the gateway can see is defined by the Kickbite user's market access — set it deliberately.
Session length. Sessions refresh automatically; a full re-login is only needed after the refresh window elapses.
Headless / direct-API alternative. If you're integrating Kickbite's REST API directly (not via the MCP), you can authenticate the same account with
POST https://admin.kickbite.io/auth/tokento obtain access + refresh tokens. The MCP path above is recommended for gateways.
Need help?
To allowlist your gateway's callback host, or if you have questions about scoping a service account, reach out to your Kickbite contact and we'll get you set up.