Skip to main content
Availability: generally available to all partners.
Members connect AI apps such as ChatGPT, Claude and Cursor to Thread by signing in with their Thread account. Each app acts with that member’s own permissions. Workspace admins can decide who is allowed to connect at all, see every app that’s connected, and cut off any app with one click. Prerequisites:
  • You are a workspace admin to change who can connect. Team admins can open the page, see the apps connected by members on their teams, and revoke them, but they can’t change the setting.
  • The MCP keys tab is available on AI Pro. On AI Essentials, the page shows the Connected apps tab only, and connected apps can read but not make changes.

​
Open the Thread MCP page

  1. Open Admin → Thread MCP.
  2. Select the Connected apps tab.
The page replaces the old MCP keys page. Old links to the keys page redirect to the MCP keys tab here. You can also get to it from Super Magic settings with Manage Thread MCP access. The Connected apps tab has two parts:
  • Access: who can connect apps, plus the connector URL with a Copy button.
  • Connected apps: every AI app a member has connected, including apps that have never made a call.
Thread MCP page in Thread Admin with the Access card, the connector URL, and a table of connected apps with a Revoke button on each row

The Connected apps tab: who can connect, the connector URL, and every connected app.

​
Choose who can connect apps

  1. Next to Who can connect apps, select Edit.
  2. Pick one option:
Who can connect apps drawer with the dropdown open, showing All members, Only admins, Custom and Off for everyone

Choose who can connect apps.

  1. Select Save.
Who can connect apps drawer set to Only admins, with a warning that 2 members will lose access and the apps they use

If a change would cut someone off, Thread lists who will lose access before you save.

Who can connect apps drawer set to Custom, with the list of members who will lose access and a search box to add members

With Custom, add the members who can connect. The warning updates as you choose.

Saving a tighter setting takes effect right away. If the change would cut off members who have connected apps or MCP automation keys, Thread lists them with their apps and keys, and asks you to confirm with Revoke access. Their apps are disconnected, their MCP automation keys are revoked, and they can’t reconnect unless you include them again.
What happens after you save:
  • Apps connected by members who are no longer allowed stop working right away. Thread checks access on every call, so an app that is already connected stops on its next request.
  • They can’t connect a new app, and nobody can create an MCP automation key for them, including an admin.
  • In Inbox, under Magic → Connectors, they see Connecting AI apps is turned off for your account instead of the connector URL.
  • Loosening the setting later doesn’t bring anything back. Revoked apps stay revoked, so members connect again and admins issue new keys.

​
Review connected apps

The Connected apps table lists one row per member and app: Workspace admins see every connection in the workspace. Team admins see connections for members on their teams.

​
Revoke an app

  1. Find the member and app in the Connected apps table.
  2. Select Revoke, then confirm.
Connected apps table with the pointer over the Revoke button on one row

Revoke disconnects one app immediately.

The app is disconnected immediately and the row stays in the table marked Revoked. Revoking ends that one app’s sign-in. It doesn’t block the member: if they’re still allowed to connect, they can sign in again. To keep someone out, change Who can connect apps so they’re no longer included. Team admins can revoke apps for members on their teams, but not apps connected by workspace admins or other team admins. Members can also disconnect their own apps from Inbox: Magic → Connectors → Your connected apps → Disconnect.

​
MCP automation keys follow the same setting

Automation keys for n8n, CI and scripts live on the MCP keys tab of the same page. Keys follow the Who can connect apps setting: when a member loses access, their keys are revoked along with their apps, including keys an admin issued for them. See Issue MCP automation keys for team members.
MCP keys tab with a table of automation keys showing name, member, masked token, last used and status

The MCP keys tab. Token values are masked.

​
Things this setting doesn’t change

  • What a connected app can do. An app can only see and do what its member can in Thread. To limit what members can do, use write access and tool toggles in Super Magic settings, and Access Groups to limit which clients they see. See Super Magic Admin Guide: Setup, Access & Safety.
  • Super Magic in Inbox. Turning Super Magic off doesn’t block Thread MCP, and this setting doesn’t affect Super Magic chat.

​
FAQ

Do members need to reconnect after I restrict access? Members who are still allowed keep working with no change. Members who lost access are disconnected and can’t reconnect until you include them again. Then they connect again from their AI app. Why does Last used say Never for an app I know was used? Last used only looks back 30 days. Never means the app made no calls in that window. Does Only admins include team admins? No. Only admins means workspace admins. Use Custom to add team admins who need access.