Security and confirmations
Understand credentials, workspace isolation, scopes, confirmations, idempotency, destructive actions, and revocation.
On this page
Hosted credentials stay hidden
Hosted connections use RouteKite OAuth. RouteKite creates and stores a managed workspace credential on the server; the client never receives a visible API key.
Local stdio is for self-managed development and uses ROUTEKITE_API_KEY in the process environment. Never put that key in prompts, tool arguments, source control, screenshots, or shared configuration.
Access levels and scopes
A tool call must pass both the connection access level and the server-side RouteKite scope check. Only owners, admins, and developers can approve hosted connections.
| Access | Scopes |
|---|---|
| Read | workspace:read, domain:read, email:read, template:read, campaign:read, audience:read |
| Manage | Read scopes plus domain:manage, email:send, template:write, campaign:write, campaign:send, audience:write, webhook:manage |
Confirm the exact operation
- 1
Preview
Call the change tool with confirm set to false.
- 2
Review
Check the workspace object, recipients, content, audience, storage impact, and consequences.
- 3
Approve
Approve that exact operation, not a general category of future changes.
- 4
Execute
Repeat the same tool with confirm set to true and the required idempotency key.
- 5
Inspect
Read the resulting object or delivery state instead of assuming success.
Retry safely
Transactional sending and assistant-backed campaign, audience, list, and import operations enforce stable request identity. Reusing the same idempotency key with changed input is rejected.
Configuration, template, attachment, and webhook endpoints do not all promise the same deduplication behavior. Read current state before retrying those changes after an uncertain response.
Destructive actions
Permanent deletion is available for contacts and audience lists. These tools are marked destructive, return their consequences in preview, and require confirmation.
RouteKite remains authoritative
MCP cannot bypass workspace isolation, roles, scopes, sender readiness, consent, suppression, rate limits, attachment limits, published-template rules, campaign preflight, or billing-funded sending capacity.
Unexpected internal failures are redacted. Customer-safe errors can include a request ID without exposing credentials or infrastructure details.
Review and revoke access
Developers, then MCP Connections, shows the connection, approved access, last use, and privacy-safe recent activity. RouteKite stores tool name, outcome, client, duration, and time, not arguments, email content, credentials, or response bodies.
Revoking the connection disables its managed credential before attempting to close the OAuth grant, so partial revocation fails closed.