Learning Studio / agents

Authenticate integrations

Every integration acts with the caller’s permissions.

Connect an assistant through MCP or use HTTP for a custom integration. Both act with the signed-in caller’s permissions.

Choose a connection

The endpoints belong to your Learning Studio app origin: /mcp for MCP and /api/public/agent for HTTP. This help center doesn’t host them.

For MCP, complete the app’s OAuth sign-in and consent flow in a compatible client. For HTTP, send a valid user access token in the Authorization header:

Authorization: Bearer <user access token>

A publishable project key isn’t a user access token. The API verifies the bearer token with Supabase Auth and the returned client carries that token so row-level security applies exactly as it does in the app. Knowing a course ID doesn’t grant access.

Start read-only

Use discovery or list courses, then select the intended course and read its current version before proposing a write. If a course is missing or inaccessible, check the account and access rather than trying to bypass ownership.