Permissions and security

A KickBot API key or connected app acts as one team member on one channel. It has that member’s dashboard permissions, and KickBot checks them again on every request. This page explains the rules, the activity log, and the OAuth setup for developers of MCP apps.

What a key or app can do

• It has the team member’s current dashboard permissions. If the owner or an admin changes them in Manage Team, the key or app changes at once.
• The owner and admins can always use the API. Other team members need the API & MCP access permission. See Team.
• Each area of the API needs the matching team permission, for example Custom commands for the commands area. Each reference page names the permission it needs.
• A read-only key or connection can only call read actions. A write action returns forbidden.
• If a team member is removed, their keys and connections stop working. They stay dead even if the member is invited again later.

No key or app can send chat messages directly, see or change billing, payouts or the Stripe setup, manage your team, or use admin features.

Activity log

KickBot logs every change made through the API or MCP, with the time, the key or app name, the action and the result. You see it in Recent API activity on the API & MCP page. Owners and admins see all activity on the channel. Other team members see their own.

Read actions are not logged.

Good practice

• Give each script or agent its own key, so you can revoke one without breaking the others.
• Use read-only keys where you can.
• Set an expiry on keys you only need for a while.
• Revoke keys and disconnect apps you no longer use.
• Keep keys out of prompts, chats and code repositories. KickBot keys start with kb_live_, so secret scanners can find a leaked key.

OAuth details for app developers

KickBot is an OAuth 2.1 authorization server for MCP clients.

Item	Value
Protected resource metadata	https://kickbot.com/.well-known/oauth-protected-resource/api/v1/mcp
Authorization server metadata	https://kickbot.com/.well-known/oauth-authorization-server
Authorization endpoint	https://kickbot.com/oauth/authorize
Token endpoint	https://kickbot.com/api/oauth/token
Dynamic client registration	https://kickbot.com/api/oauth/register
Revocation	https://kickbot.com/api/oauth/revoke
Scopes	read, write (request read write for full access)

• Only the authorization code flow with PKCE (S256) is supported.
• Public clients (no secret) are the default. Confidential clients can register with client_secret_post or client_secret_basic.
• Client ID metadata documents are supported for known MCP clients (for example Claude, ChatGPT, Grok, VS Code and Cursor). The client_id is an https URL on the client’s own site that serves its metadata. Other clients use dynamic client registration.
• Access tokens last one hour. Refresh tokens rotate on every use and last 60 days. If an old refresh token is used again, KickBot revokes the connection.
• A request without a valid token gets HTTP 401 with a WWW-Authenticate header that points to the protected resource metadata.

Report a security issue

Email support@kickbot.com with the details. Do not post a security issue in a public channel.