What we did
Connecting an MCP client used to start with creating a token and pasting it into a config file. Now clients that support OAuth need only the address https://mcp.qretro.com — they will bring you to QRetro, ask you to sign in, and show what exactly they are requesting.
What's new
- Sign-in based connection for MCP clients: no token to copy, and the client refreshes its access on its own.
- An approval screen that names the application, shows where you will be returned, and lists the permissions being requested.
- A "Connected applications" block in Settings → API Keys: see what has access and cut it off in one click.
Why it matters
A pasted token lives in a config file until someone remembers to delete it, and nobody sees what it can do. A connection you approve is visible, limited to the permissions you agreed to, and can be revoked from the same place you granted it.
Access keys have not gone anywhere: clients that send a fixed Authorization header still work exactly as before, and only tokens can be limited to a single team or granted delete permission.
