Connect an Agent

Start With the Agent's Capabilities

Coil does not run the AI model. Your agent uses Coil's tools/API with a workspace-scoped key. MCP clients can discover tools; HTTP-capable agents can use the documented API directly. A public docs URL requires no credentials, but execution always does.

1. Identify the intended tasks: read-only analysis, receipt/purchase processing, sales report imports, stock operations, or bookkeeping.
2. Check whether the client supports remote Streamable HTTP MCP and a fixed Authorization header. An OAuth-only client is not supported by the current connector.
3. For binary uploads only, confirm access to the original file and a shell/binary HTTP client. If those are unavailable, use Coil's manual upload workflow.
4. Check network policy before promising a connection. The MCP endpoint and production upload host are on www.usecoil.app; no upload redirects are used.

Create a Workspace Key

1. A workspace owner opens Settings > Agent Access and creates a named, expiring key.
2. Select the smallest preset/permissions that cover the intended tasks. Add finance, deletion, or other privileged scopes only deliberately.
3. Enter the key in connector settings or a local secret manager. Never paste it into the conversation or documentation URL.
4. Use separate keys for separate agents/tasks, and revoke a key when it is no longer needed.

Configure Remote MCP

The JSON is a generic URL-capable client's example, not a promise that every client accepts the same configuration file. Use your client's connector UI or current configuration format. Set network allowlists separately where your organization requires them.

1. Add a remote/custom connector named Coil. In current Claude clients this is under Customize or Settings > Connectors.
2. Set the server URL to https://www.usecoil.app/api/mcp.
3. Choose the fixed-credential/no-OAuth option, currently labeled No sign in in Claude, and add Authorization: Bearer YOUR_COIL_API_KEY as a request header.
4. Enable the connector for the conversation and review tool-approval settings. Do not automatically approve financial or destructive actions.
5. Reconnect after API changes so the client refreshes schemas. tools/list exposes only tools authorized by this key, not every tool in the public reference.

{
  "mcpServers": {
    "coil": {
      "url": "https://www.usecoil.app/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_COIL_API_KEY"
      }
    }
  }
}

Configure Direct API Access

All operation calls use POST /api/automation/OPERATION with a bearer key and JSON. GET /api/automation/schema is authenticated, exposing only contracts available to that key. /docs/api.json is the public, full reference. Existing UI-session routes are not unlocked by API keys.

curl "https://www.usecoil.app/api/automation/list_products" \
  -H "Authorization: Bearer $COIL_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"limit":25}'

Verify a Read Before a Write

Start with list_products or get_inventory_summary. Confirm the response is from the intended workspace and that expected tools are discoverable. Then read the relevant record/version or prepare a preview before requesting changes.

Read https://www.usecoil.app/docs/agents and the linked reference.
Tell me what your current client supports, the permissions my tasks require,
and the configuration I must enter locally. Do not ask me to paste a key in chat.
Start with read-only checks; show proposed changes before applying them.

Delegation Boundaries

No agent tool can manage team access, keys, billing, global administrators, or workspace time zone and default tax settings. Giveaways use a dedicated reviewed preview and permission; other stock-removal reasons are not exposed. Do not promise an unsupported task just because a similar UI operation exists. Discover the actual permitted tools and use the workflow guide for reads, versioned edits, previews, and retries.