Connect an AI assistant

Before you start, read MCP if you haven't. It covers what MCP is and the most important thing to know: What asks for approval depends on your AI app.

Open the connection popup

1. Click MCP in the top bar, in the group beside the dark-mode switch and the bell. The button is hidden on a narrow screen: there, open your user menu and choose the MCP row. Both open the same popup.
2. If you cannot see MCP, your role does not include View API keys. Only people with that permission get the button and the menu row, so ask the store owner to change your role under Settings → Team.
3. The popup is titled Connect your store to your AI assistant. It shows the MCP address with a copy button. This is the one address to paste into Claude (desktop or web), Cursor, Claude Code and any other MCP client that opens a sign-in window by itself. The icon cards fill it in for you, so you rarely type it. ChatGPT is the exception, see below.
4. Next to the MCP address label are four small round icons: Claude, ChatGPT, Cursor and Claude Code. Point at an icon (or tap it on a phone) and a card opens with that assistant's numbered steps and copy buttons for every address and command. Only one card is open at a time.
5. Under For building a storefront, the popup also writes out two one-line prompts for a coding agent: Build a new storefront and Connect an existing project, each with a copy button. Paste one into Claude Code or Cursor and the agent reads the setup instructions itself. Those two lines build a website. They do not connect an assistant to manage your store. To manage your store from an assistant, use the address and the icon cards above them.
6. At the bottom, Create an API key takes you to Settings → API keys for a tool with no sign-in window (a terminal on a server, for example), and More options: API key and other tools opens the fuller Connect AI assistants dialog described in Connect your AI client.

The screenshot above shows the popup opened from the MCP button in the top bar, with the Claude card open. It is not the Settings → API keys page, where keys are created.

Settings → Customer login is not part of MCP. It controls how your shoppers sign in on your storefront (Google, Facebook and similar). Connecting an AI assistant never uses it.

ChatGPT's card is different. Claude, Cursor and Claude Code use the address above. ChatGPT's card has no address on it: it is an Install the plugin in ChatGPT button. See ChatGPT.

Connect your AI client

The popup's icon cards cover Claude, ChatGPT, Cursor and Claude Code, and each card shows the OAuth route only. The fuller Connect AI assistants dialog (from More options: API key and other tools) has a tab per client: ChatGPT, Claude Code, Cursor, Claude Desktop / Web and Other (JSON). It opens on Other (JSON), so click the tab for your client. Copy the block for the one you use, and the server URL is already filled in.

Claude Code

The Claude Code icon in the popup shows the OAuth command below, then says to sign in in the browser that opens and choose one or more stores. The command with an API key is in the Claude Code tab of More options: API key and other tools.

With an API key:

claude mcp add --transport http brainerce https://mcp.brainerce.com/api/mcp \
  --header "Authorization: Bearer brainerce_YOUR_KEY"

With OAuth (opens a browser sign-in, with no key to manage):

claude mcp add --transport http brainerce https://mcp.brainerce.com/api/mcp

With no key in the command, Claude Code opens a browser window where you sign in to Brainerce and choose your stores. If it does not open by itself, run /mcp inside Claude Code, pick brainerce and choose to sign in.

Add the Brainerce plugin to teach Claude how Brainerce works. The address gives Claude the actions. The plugin adds the skills: how to launch a sale, work an order, onboard a product or check the health of a store the way Brainerce expects, so Claude picks the right action instead of guessing. In Claude Code run /plugin marketplace add brainerce/ai-toolkit, then /plugin install brainerce@brainerce. In Claude on the web or the desktop app open Customize → Plugins → Add → Add marketplace and enter brainerce/ai-toolkit. The plugin gives Claude no permission that the sign-in does not already give, and refunds and payment settings stay in the dashboard with or without it.

Prefer OAuth here if you can. Categories, tags, brands, product options, product custom fields, add-on options, order bumps, bundles, shipping zones and rates, loyalty, store settings, contact forms, email domains, installing an app and switching a channel live only work over OAuth, and an API key cannot reach them however it is scoped. See some actions need you to sign in.

Cursor

Add this to ~/.cursor/mcp.json (or .cursor/mcp.json in your project), then sign in when Cursor prompts you:

{
  "mcpServers": {
    "brainerce": {
      "url": "https://mcp.brainerce.com/api/mcp"
    }
  }
}

The Cursor icon in the popup and the dialog both have a one-click Add to Cursor button that does this for you. Cursor asks you to confirm the install, then opens a browser window where you sign in to Brainerce and choose which stores to connect. You do this once: Cursor keeps the connection and renews it by itself, so there is nothing to sign in to again each hour.

Cursor lists the server but every action fails? It is not signed in. Open Settings, then MCP, find brainerce and choose its sign-in button. Do not paste a token into mcp.json by hand: a hand-pasted token expires after one hour and Cursor cannot renew it, so remove it and sign in from the MCP settings instead.

Claude Desktop / Claude Web

The fastest way in Claude (desktop or web) is the Add to Claude button, on the Claude icon in the popup and on the Claude Desktop / Web tab of the dialog. It opens Claude's Add custom connector window with the name and the address already filled in, and a notice that they came from a link. Check them, confirm, then sign in to Brainerce and choose one or more stores. Claude never adds anything until you confirm.

To do it by hand instead, open Customize, then Connectors, choose Add custom connector, paste https://mcp.brainerce.com/api/mcp, then sign in and choose one or more stores.

ChatGPT

The Brainerce plugin is the short way

In the connect popup, point at the ChatGPT icon (or tap it). Its card has two steps: click Install the plugin in ChatGPT, which opens the Brainerce plugin page in ChatGPT, then sign in to Brainerce and choose one or more stores. The card has no address to copy and no developer mode to turn on. You can also open the Brainerce plugin page yourself and click Install plugin. It is the same 49 actions as the address in Adding the address by hand, so everything in this article about what ChatGPT can and cannot do applies to it too.

The popup's ChatGPT card offers the plugin only. If the plugin is not available to you yet, or you want the compact address described further down, the manual route is still there: click More options: API key and other tools at the bottom of the popup, open the ChatGPT tab, and follow Adding the address by hand.

Open a new store from ChatGPT, with no dashboard

You do not need a Brainerce account, or a store, before you start. Enable the Brainerce app in ChatGPT, then say what you want in plain words: "open a shop for my candles", "build me an online store and add these three products". ChatGPT does the work first. The moment an action needs your store, ChatGPT opens Brainerce's sign-in window once.

• No account yet? Click Create an account in that window and sign up there.
• No store yet? The same window asks for a store name and a country, creates the store on the spot, and shows the permissions ChatGPT is asking for. Click Allow.

The window closes and ChatGPT carries on with the store it just created. Nobody visits the dashboard and nothing is copied or pasted. The store starts on the Free plan, with no card needed. Country sets the default currency and language, so pick the country you sell from. Both can be changed afterwards, from ChatGPT or from Settings, but a currency change relabels every price without converting anything, so do it before you add prices.

What the ChatGPT app can do

In plain words, the Brainerce app in ChatGPT can, with its 49 actions:

• Name your store, set its country, its currency and its default language, and whether prices include VAT. Changing the currency relabels every price; nothing is converted, so ChatGPT asks you to confirm once the store has orders and refuses while a checkout is in progress. Changing the default language does not translate anything.
• Tell you what is still missing before you can sell. Ask "what is left?", "how do I start selling?" or "is my store ready?" and it checks six things: store name, a sales channel, products published to it, a shipping option, a payment provider that is live, and tax. Each comes back as done or not, with the next step. A payment provider in test mode counts as not done, because test mode declines real cards.
• Add a product with a picture, from a link. Give ChatGPT a direct link to the picture file (ending in .jpg, .png or .webp) and say "add this to my store". Attaching a photo to the ChatGPT conversation does not work: that route was withdrawn in September 2026, so a photo dropped into the chat does not become the product image. Use a link, or upload the picture in the dashboard Media Library first.
• Add, edit and duplicate products, put them in categories and tag them.
• Set stock, for a simple product or for one size or colour of a product with variants.
• Publish products to your storefront, one at a time or the whole catalog at once. A product is not visible on a storefront until it is published to that sales channel, and adding a product does not publish it. Ask "publish it to my shop", or "put all my products on the storefront".
• Create a sales channel for a storefront, list the ones you have, and switch a channel live: once your site is deployed at its public address, ChatGPT records that address and moves the channel from test to live. A channel in test mode takes no real orders. This does not deploy anything and does not connect a payment provider.
• Add a shipping zone and a shipping price: which countries you deliver to (or everywhere), then a flat rate, free delivery over an amount, a weight-based or order-value-based rate, or local pickup. A zone with no price on it offers nothing at checkout.
• Add a tax rate. Switch tax on, then add the rate you give it, for a country or a region. ChatGPT uses the number you say and never one it assumes; the rate is your legal figure, and nothing is registered or filed anywhere. With tax on and no rate, checkout charges 0 tax.
• Work orders: find them, see who bought what, mark as shipped with tracking, move the status, cancel.
• Look up customers and their order history.
• See what shoppers saved to their wishlist. Ask "how many people saved each of my products?", "who saved the linen shirt?" or "what did this customer save?". The product list and product lookup can add a saved count (and for one product, who saved it), and the customer list and customer lookup can add each customer's saved count (and for one customer, the saved products). This needs the permission to read customers, because it shows names and emails, and it counts signed in customers only: a guest saves in their own browser and is never counted. It is view only; ChatGPT cannot add to or edit anyone's list. See Wishlist and saved items.
• Create voucher codes (a code the shopper types) and automatic discounts (no code), and list both.
• Report on sales: a snapshot of product counts, order counts (today, this week, this month, waiting to ship) and revenue, with a 30 day daily series.
• Read product reviews and ratings, and order statistics.
• Manage team permissions: see who is on the team and what each person may do, and give or take away one permission at a time. The assistant says who would get what and waits for your yes, and a sensitive permission (billing, API keys, team management, the developer portal, customer data) takes two steps.

What the ChatGPT app does not do. It has a fixed set of actions, so anything not listed here is done in the dashboard, or in Claude, which can reach the rest of the platform: loyalty, gift cards, subscriptions, blog posts, email campaigns, shipments and labels, translations, bulk edits, the contact-form inbox, apps, webhooks, backups, and inviting, changing the role of or removing a team member. It never issues refunds, records payments, or connects a payment provider.

Actions that change your store are marked as such, so ChatGPT asks before running them.

What Claude, Cursor and other assistants can do

Claude Code, Cursor, Claude Desktop and any other client connected to the plain address see the full set: 580 actions, everything the ChatGPT app has plus, in plain words:

• Store settings: timezone, contact email and phone, social links, brand colours, logo, homepage description, which dashboard sections are on, extra storefront languages, and activating a store that sells without a payment provider (cash on delivery, bank transfer).
• Products in depth: variants, product options, add-on options (gift wrap, toppings), kit contents, custom-field definitions, translations, regional prices, pricing formulas, bundles and order bumps, hiding a product from Google Shopping without unpublishing it, and bulk edits (prices, stock, status, categories, tags, publishing).
• Stock in depth: the movement history of one product, how fast each product sells, which units are held back from sale and why (damaged, quality control, safety stock), your stock transfers between locations and what is still on the way to a product (read-only), and reserving part of the stock for one sales channel. A channel reservation does not add or remove stock; it only decides who may sell it. Warehouses and suppliers stay in the dashboard; purchase orders have their own tools, next.
• Purchase orders: list and read them, create a draft, edit one that nothing has arrived on (supplier, dates, destination warehouse, items, costs, supplier SKU, carrier, tracking number, currency), record units that arrived (optionally updating each product's cost price), close an order that will never arrive in full, cancel one, get the PDF, and email it to the supplier. Receiving adds units to your inventory, so the assistant confirms the quantities with you first. Emailing goes only to the address on the supplier's record, never to one the assistant is given, and it does not mark the order as ordered. An order is made against a supplier that already exists: adding or editing the supplier record is a dashboard task, and so is everything about warehouses. An order in another currency than your store's can be received but never changes a cost price.
• Orders in depth: create an order by hand for a phone or counter sale (it reserves stock, sends no confirmation email and records a shipping amount rather than a method; running it twice creates two orders), refunds, returns and exchanges (list and read returns, check what an order can still return, open one for a customer, approve, decline and record what arrived; closing a return with a refund is not available through the connector, like any refund, so do that in the dashboard or in BOBO; an exchange moves no money and creates no replacement order, and the connector cannot create a return label from a return, offer store credit or handle a guest's return; reading returns needs the View Returns permission and the other steps Manage Returns), mark as paid, change the shipping address, edit the items of an order that has not shipped (add a product, remove a line, change a quantity: it never charges or refunds anything, so a paid order whose total changes is left with an amount to collect or to refund that you settle yourself), your own status labels, order custom fields and their definitions, and the fields shoppers fill in at checkout.
• Shipping in depth: edit and delete zones and rates, shipping classes, a preview of what a buyer at an address would pay, the address you ship from, parcels and tracking, and buying a carrier label. A label costs money at your carrier, so the assistant quotes first and buys only after you confirm; carrier credentials are entered in the dashboard, never through the assistant, and the parcel tools work only once a shipping app is connected.
• Customers in depth: addresses, the contact-form inbox (read messages, reply to the shopper, leave a staff-only note), contact forms themselves, the storefront bot's settings and conversations, and the newsletter benefit. A reply to an inquiry emails the shopper at once and cannot be edited or recalled.
• Marketing in depth: edit and delete vouchers and discounts, gift cards, donations, subscriptions, email campaigns, and the loyalty club: the programme, its earning rules (signup, review, social share), rewards, tiers, badges, paid membership plans and referrals. A club earns points through its per-order rate and its earning rules; a club with neither set up earns nothing. The assistant can create a paid plan but cannot cancel a member's subscription; the member does that from their own account.
• Content: pages, FAQ, header, footer, announcements, the blog, the media library, and product reviews (hide or show).
• Events, only for a store Brainerce has opened Events for. Events are in a limited rollout, so on every other store each events action answers that the module is not switched on. Where it is on, the assistant can list, create, edit, publish, take back to draft and archive an event, read the attendee list, cancel or resend a registration, and delete the test registrations. Cancelling a whole event emails every registrant, and refunding a registration moves money back to the customer, so those two are not reachable through the search-and-run route: they are only available to a client that lists every action. There is no attendee CSV action: that file leaves Brainerce, so it stays a dashboard download.
• Email: edit, preview, reset and roll back the order emails, send a test to your own inbox (never to a customer), read the send log, and add a custom sending domain. Adding a domain returns the DNS records to paste at your registrar; checking it re-reads the status and does not trigger verification, which happens on its own after the records propagate.
• Apps: browse the marketplace, install an app and change its ordinary settings, pause, resume or remove it, and run a connector sync. The assistant can never enter or read an API key, password or token; those go in only in the dashboard, and a payment gateway installed from chat takes test cards only until you connect it live there.
• Webhooks and backups: see whether webhooks are healthy, edit, pause, test or delete a subscription; start an export or full backup, list them, get the download link, and set the backup schedule.
• Reports in depth: repeat customers and retention, voucher and discount performance, a stock summary, storefront traffic by country, source, device and funnel, whether each storefront is connected, and loyalty performance.
• Team: invite a member, change a role, give or take away individual permissions (for example "let Dana manage webhooks"), return someone to their role's defaults, and remove a member. The assistant says who would get what and waits for your yes before each of these. Giving billing, API keys, team management, the developer portal or customer data needs two steps: it first shows you exactly what would change, and acts only after you confirm. It cannot give a permission you do not hold yourself, and it cannot change the store owner.
• Deleting products, vouchers, discounts, categories, tags and the rest.

Everything the assistant does still runs inside the permissions you granted at sign-in and the permissions you hold in the dashboard today.

What still needs the dashboard

No assistant can do these, ChatGPT included, and if it says so it is telling you the truth. Do them at brainerce.com:

• Connect a payment provider and switch it to live mode: Apps → Browse → Payment Gateways. An assistant can install the app; the credentials, the sign-in with the provider and the switch to live are entered only in the dashboard. Until a provider is live, the store cannot take real money.
• Enable that provider for each region you sell to: Settings → Regions.
• API keys: creating, rotating and deleting them.
• Webhooks: creating a subscription and rotating its secret, because both show the signing secret once.
• Restoring a backup.
• Carrier credentials for a shipping app, and every other password, key or token.
• Warehouses and suppliers, and drawing a delivery area on the map.
• SEO Autopilot, Search Console and ads campaigns.
• Billing, plan changes, transferring or deleting the store.

On the ChatGPT app specifically, these are dashboard work too, because its 49 actions do not include them:

• Tax rates beyond adding one: editing or deleting a rate, and tax classes. Settings → Tax.
• Delete anything: products, vouchers, discounts, categories. ChatGPT can leave a product as a draft; it cannot delete.
• Refunds and marking an order as paid. Money never moves from ChatGPT.
• Change a customer's shipping address on an order, or create an order by hand.
• Bulk edits beyond publishing, and CSV imports, including the Migration Tool.
• Blog posts, pages, the header and footer, SEO and email campaigns.
• The media library (browsing pictures you already uploaded). Attaching a photo to the ChatGPT chat is not a substitute either (that route was withdrawn): give ChatGPT a direct image link, or upload the picture in the dashboard Media Library.
• Add-on options (gift wrap, toppings), custom-field definitions (creating a new field, rather than filling one in), kit contents, and digital or downloadable products.
• Timezone, contact details, colours, logo and extra languages on the store settings.
• Shipping classes, parcels and labels, and editing or deleting a zone or a rate.
• The contact-form inbox, loyalty, gift cards, apps, email settings, webhooks and backups.
• Events. The ChatGPT app has no events actions.
• Inviting, role changes and removing members in the ChatGPT app. The ChatGPT app can list the team and change individual permissions; Claude can do all of it (see above).

Adding the address by hand

If the plugin is not available to you, or you want the compact address described further down, ChatGPT calls a custom MCP connection an "app," and gates it behind a developer-mode toggle. It can't vet every server a user might add, so it hides the option by default.

Start from the dashboard: MCP in the top bar, then More options: API key and other tools, then the ChatGPT tab. That tab shows the address to paste (it differs from the main MCP address, see the next section), its three steps, and an Open ChatGPT connector settings button. The steps in ChatGPT are:

1. In ChatGPT, open Settings → Apps → Advanced.
2. Turn on Developer mode (labeled Elevated risk, which is what allows adding unverified connectors that could modify or erase data).
3. Go back to Apps and click Create app.
4. Give it a Name (e.g. "Brainerce"). Icon and Description are optional.
5. Under Connection, keep Server URL selected and paste https://mcp.brainerce.com/api/mcp/openai. This is the address that works in ChatGPT, and the ChatGPT tab of the Connect AI assistants dialog shows exactly it, so you can copy it from there. If you paste the plain address instead, the connector signs in and then has no actions at all.
6. Leave Authentication set to OAuth.
7. ChatGPT shows its own risk notice at this point. Check I understand and want to continue, then click Create.
8. Sign in on the Brainerce screen that opens, choose one or more stores, and approve the requested permissions.

ChatGPT's own warning here is worth reading before you check the box: "Custom MCP servers introduce risk... OpenAI hasn't reviewed this MCP server. Attackers may attempt to steal your data or trick the model into taking unintended actions, including destroying data." It's making the same point as our warning, from the other side of the connection. Take it seriously.

Why the ChatGPT address is not the plain one

Brainerce gives an assistant every product, order, discount and content operation as its own action, several hundred in all and more with every release. ChatGPT has a ceiling on how much of that list it will load, and Brainerce is well over it. Paste the plain https://mcp.brainerce.com/api/mcp into ChatGPT and the likely result is a connector that signs in fine but then can't do anything, because none of the actions loaded. Nothing tells you that happened, which is why this matters more than it sounds.

The /openai address is the same store and the same permissions, cut to the 49 actions that run a store day to day: products, stock (including per variant), publishing products to a storefront one at a time or all at once, categories, tags, orders, fulfilment and cancellation, customers, voucher codes, automatic discounts, sales channels and switching one live, shipping zones and prices, the store's name, currency, language and tax settings, a tax rate, a setup checklist, and the analytics summary. Each one is listed by name, so ChatGPT picks the action it needs and runs it. The full list in plain words is under What the ChatGPT app can do.

What is not on this address. The remaining actions are absent rather than hidden: blog and content, SEO, email campaigns, the media library, loyalty, apps, editing or deleting a tax rate, payment providers, refunds and every kind of deletion are dashboard work from ChatGPT. If ChatGPT tells you it cannot do one of those, it is telling you the truth. The list is under What still needs the dashboard, and the address below reaches most of them.

If you need an action /openai does not carry

https://mcp.brainerce.com/api/mcp/compact is the other supported address for ChatGPT. It serves 9 definitions instead of 49: one search action, three run actions, and the visual tools. Every action on the full address stays reachable through that search step, so nothing in Brainerce is switched off.

The cost is that the assistant has to find the action before it can run it, and it does not always succeed. It may report that something "isn't available" when it is, or reach for a near-miss action instead of the one you asked for. That is the trade: /openai is more reliable for everyday store work, /compact reaches everything but with a search step in front of it.

You can add both, under different names, and pick per conversation.

Cards

Both addresses draw Brainerce's visual answers, the product list, the order list and the analytics summary, because the tools carrying them are listed directly on each. ChatGPT is the only client that renders these; everywhere else the same answers arrive as text.

You can use a card, not only look at it. The product and order cards have next and previous buttons that turn the page inside the card, keeping whatever you asked for: ask for draft products only, and page two is still draft products only. All three cards have an expand button that opens them full screen, and a row of suggestion buttons along the bottom that change with what the card is showing, so a list with sold out items offers to restock them and a list with unpaid orders offers to show what is owed.

A suggestion button never changes anything by itself. It writes the request into the chat for you, the same as typing it, and the assistant answers and asks before it changes stock, an order status or anything else. This is deliberate: the button saves you the typing, not the decision. If you want the change made, reply to what the assistant asks.

The buttons appear in your own language when you are working in Hebrew or English, and in English otherwise.

Cards only appear in ChatGPT. In Claude, Cursor and every other client the same information arrives as text, with no buttons, and you ask for the next page in words.

Other MCP clients

Most MCP clients accept a JSON block like this. Add the Authorization header when using an API key, or drop it and sign in with OAuth instead:

{
  "mcpServers": {
    "brainerce": {
      "url": "https://mcp.brainerce.com/api/mcp",
      "headers": {
        "Authorization": "Bearer brainerce_YOUR_KEY"
      }
    }
  }
}

Check who is asking before you click Allow access

When you connect by signing in, Brainerce shows a screen that names the app asking to connect and where your access will be sent. Read that line before you approve, because approving hands that app the ability to act in your store as you.

A recognised platform shows a green "Recognised platform" mark. ChatGPT, Claude and Cursor complete the connection on their own servers, and Brainerce recognises them by the address the access is sent to (a chatgpt.com, claude.ai or cursor.com address), never by the name or logo the app chose. The mark carries the address the access goes to, for example claude.ai. The one thing to check there is that you started this connection yourself, from inside that app. The screen does not repeat that as a sentence, so keep it in mind. A link to this screen that someone else sent you is the only way a recognised platform can be misused, so a link that arrives by email, chat or SMS is a reason to click Cancel.

A desktop tool shows "Runs on this computer". Claude Code, Cursor's desktop app and VS Code receive the access on your own machine (a localhost or 127.0.0.1 address). Continue only if you started the connection from a tool running on this computer.

Anything else shows "Not a recognised app", in amber. Any developer can register a connector and give it any name and any picture. A connector that calls itself "Brainerce Billing" or "Brainerce Support" is not from us, and Brainerce does not check names. The address shown in that box is where your access is actually delivered; it has to match the address the app registered with us, so it cannot be faked in the link someone sends you. If you do not know that address, click Cancel, which is the default button on that screen.

Brainerce will never email you a link to this screen. You reach it by starting the connection from inside your AI client.

Approving does not give away your password. It gives the app the permission areas shown under What this connection can do, in the stores you pick, and nothing else. The screen also shows which Brainerce account you are signed in as, with Switch account beside it, and links to the Terms of Use and Privacy Policy at the bottom. The store line under Store to connect shows one store, or a single line such as All my stores. With more than one store, click Change to choose One store, Choose which stores (tick the ones the app may reach) or All my stores (every store you can access, including ones you create or join later). In each store the app can only do what your role there allows. Click Customize to untick permission areas before you approve. The areas are Products and inventory, Orders and checkout, Customers, Discounts and pricing, Shipping, Storefront and settings (store settings, sales channels, pages, blog posts, emails and the shopping assistant) and Other permissions. Click What each area includes to read what each one covers, and Show technical details there to list exactly which permissions each one contains. If you untick everything the screen says "Select at least one area, or the connection will not be able to do anything." The buttons are Allow access and Cancel; on an app Brainerce does not recognise, Allow access becomes Allow anyway. If you have too many stores to tick one by one, the screen asks you to pick one store or all of them. There is no screen in the dashboard that lists your OAuth connections: to cut one, remove the Brainerce connector inside your AI client.

Create a scoped API key

If you're using the API-key path (instead of OAuth), create the key first so you have it ready to paste.

Check first that a key can do the job you have in mind. Categories, tags, brands, product options, product custom fields, add-on options, order bumps, bundle offers, shipping zones and rates, loyalty, store settings, contact forms, email domains, installing an app and switching a channel live are not reachable with an API key at all, whichever permissions you tick below. Those need an OAuth sign-in instead. See some actions need you to sign in.

1. Open Settings → API keys (in the DEVELOPERS group of the settings menu) and click Create API Key.
2. Give it a Key Name that identifies the AI client, like "Claude Desktop" or "Support bot."
3. Under Start from a preset, pick Custom, Storefront, Read-only or Full access, or leave Custom and tick permissions yourself. The Permissions list has one row per area (Products, Orders, Customers and so on) with a Read and a Write column. Tick only what the AI needs: for example just Read on Products if it should only answer questions, and add Write only for the areas it should change. Select all, All read-only and Clear change the whole list at once, and the filter box narrows it.
4. Full access ticks every permission in the list. A key made from it can do everything a key can do in that store, so avoid it for an AI tool unless you fully trust the tool.
5. (Optional) Set a Rate limit (requests/min) below your plan's cap, and an IP allowlist (optional) (one IP or CIDR range per line) to restrict which addresses can use the key. Rejected attempts are logged.
6. Click Create API Key and copy the value shown, because it's displayed only once.

A key belongs to one store: the store that was selected when you created it. To connect two stores with keys, create a key in each. An OAuth sign-in can cover several stores in one go.

What it can do

The Admin MCP server exposes its tools grouped by area:

Every tool call is scoped to the permissions you granted: an OAuth session or API key with only products:read can't touch orders or customers, no matter what the AI asks for.

Some actions need you to sign in and will not work with an API key

This catches people out, because it is not a permissions problem you can fix by ticking another box. A whole group of actions only works when you connect with OAuth, meaning you signed in with your Brainerce account. Connect with an API key instead and the AI is told the action "requires OAuth authentication and is not available via API key", whatever scopes that key has.

Sign in with OAuth if you want the AI to touch any of these:

• Categories, tags and brands, including creating, renaming and deleting them
• Product options (attributes such as Size and Colour) and their values
• Product custom fields (the extra fields you define on products)
• Add-on options (modifier groups: toppings, gift wrap, warranty)
• Personalisation fields on a product, such as an engraving box
• Order bumps and bundle offers
• Shipping zones, rates and classes, and the shipping preview for an address (parcels and labels work with a key once a shipping app is connected)
• Pricing formulas
• Loyalty, all of it
• Store settings: name, currency, language, extra languages, activating the store, and switching a sales channel live
• Contact forms themselves (the inbox, replying included, works with a key)
• Email sending domains, resetting an email template, and sending yourself a test email
• Installing an app, and a channel's sync, tracking ids and integrations (configuring, pausing and removing an app work with a key)

Everyday work is unaffected: products, orders, refunds, fulfilment, orders created by hand, status labels, parcels and labels, customers, the contact-form inbox, coupons, discount rules, stock, pages, blog posts, media, webhooks, backups and the reports all work perfectly well with an API key.

The reason to care is what a confused AI does next. Asked to create a tag it cannot reach, an assistant does not always stop and tell you. It may do the nearest thing it can reach instead, and create a product with that name. If you asked for a category or a tag and something else appeared in your store, this is why. Reconnect with OAuth and ask again.

Which one am I on? If you pasted a brainerce_... key, you are on the API key. If a browser opened and you signed in to Brainerce, you are on OAuth. The OAuth commands are above, and switching is just reconnecting; nothing in your store changes.

Ebooks, courses and other downloadable products

What works depends on how you connected.

ChatGPT: not supported. A connected ChatGPT cannot create a downloadable product, turn an existing product into a digital one, or upload, replace, or browse the files a digital product delivers. If you sell ebooks, courses, printables, music, or anything else the customer downloads, set those products up yourself in the Brainerce dashboard. Asking ChatGPT to "add my new ebook" will not work, whichever permissions you granted.

Claude, or an API key connection: supported, in two steps. Ask your assistant to create the product first. It is created as an ordinary product that ships. Then give it a direct link to the file (your PDF, ZIP, EPUB, audio or video). The assistant fetches the file into your private download storage and attaches it to the product. From then on the product is a digital download, and checkout stops asking for a shipping address when everything in the cart is digital. Your AI app asks you to approve the attaching step, because it replaces the product's whole file list.

What it will not do, so it does not surprise you:

• The link must go straight to the file and be public. A Google Drive or Dropbox share link works if it is shared with anyone who has the link. A page that only shows the file, or a link that asks you to sign in, is refused.
• Files up to 50MB. For a bigger file, upload it in the dashboard.
• PDF, ZIP, EPUB, Word, Excel and PowerPoint files, audio, video, fonts and images. A plain text or CSV file is refused, so zip it first. Programs and installers are refused.
• Simple products only. A product with variants (sizes, formats) or a kit takes its files per variant, which you set in the dashboard.
• Brainerce does not scan uploaded files for viruses. Attach only files you made or trust.
• Attaching a file does not change stock tracking. If the product tracks stock and shows zero in stock, customers still cannot buy it. Turn stock tracking off for that product in the dashboard. The assistant tells you when this applies.
• Removing a file from a product, or turning a digital product back into one that ships, is a dashboard job.

Your connection stops working if your role in the store changes

If you connected by signing in (OAuth), your connection is tied to the permissions you held at the moment you approved it. The store owner changing your role, changing your permission checkboxes, or removing you from the team all cut that connection off. Your AI tool still lists Brainerce, and every action it tries is refused.

Being promoted breaks it too. This is the counter-intuitive one: moving from Staff to Manager stops the connection exactly as being demoted would, because Brainerce will not silently give an approved connection a different set of permissions than the one it was approved with.

A change made through an AI assistant cuts the connection in the same way. If an assistant changes someone's role or permissions, that person's own AI connection is cut too, so the assistant tells you when the person will need to reconnect.

Putting the old role back does not restore it, and neither does anything in the Brainerce dashboard. The only fix is to reconnect from your side: remove the Brainerce connector in your AI client, add it again using the same address as above, sign in and approve the permissions again. Nothing in your store changes when you do this.

How to tell this is what happened. The connector signs in fine but every action comes back refused or unauthorised, across the board rather than for one particular thing. If only some actions fail, that is a different problem: see some actions need you to sign in.

API keys are not affected by any of this. A brainerce_... key keeps working whatever happens to the person who created it, because it belongs to the store rather than to them. That cuts both ways, so a store owner removing someone should delete their keys too. See Team and permissions.

Best practices

• Grant only what's needed. If the AI just needs to answer questions, use read-only scopes. Add write scopes only for the parts of the store you actually want it to change.
• Lock a key to known IPs when the client runs from a fixed location (a server, a CI job). The IP allowlist on the Create API Key dialog rejects and logs everything else.
• Rotate or delete a key any time from Settings → API keys. This cuts off access immediately. For an OAuth connection, disconnect it from inside your AI client (remove the Brainerce connector there). A store owner can also cut an OAuth connection off from their side, by changing that person's role or removing them from the team, but that does nothing to API keys the person created: those have to be deleted separately, on Settings → API keys.
• Watch for leaked keys. The Audit log button on Settings → API keys shows key creation, rotation, and sign-in attempts, including from unexpected locations, but it doesn't log the individual store changes an AI made, so there's no undo trail inside Brainerce for actions it already took.
• An API key is one store; an OAuth sign-in covers the stores you tick. A brainerce_... key is created inside one store and reaches only that store. An OAuth connection reaches only the stores you chose on the sign-in screen, and in each of them only what your role allows, so connecting for Store A never exposes Store B unless you ticked both (or chose All my stores).

What's next?

• MCP explains what MCP is and the safety model.
• Team and permissions controls what your human teammates can do.

Need help connecting an AI client? Email [email protected].