Connect a desktop or CLI client

Desktop and command-line assistants (Claude Desktop, Claude Code, Codex, and custom agents) connect to Logistified with an API key sent as a bearer token. (Web-chat apps like claude.ai and ChatGPT connect differently; see Connect claude.ai or ChatGPT.)

On this page

• What you need
• The connection URL
• Connecting your assistant
• Custom HTTP clients
• Trying it out
• Connection troubleshooting
• See also

What you need

• AI / Agent access (it’s in open beta, enabled for every store on any plan).
• An API key you’ve already created and copied.
• An MCP-capable assistant that lets you add a custom MCP server with a bearer token.

The connection URL

Your store has a single MCP address. The exact URL is shown on the LLM / Agent Access page in the Connect your LLM card; it ends in /mcp:

POST https://<your-logistified-app-url>/mcp
Authorization: Bearer lstk_…

You give your assistant two things: this URL and your API key (the lstk_… value) as the bearer token.

Connecting your assistant

The exact steps depend on the app, but the shape is always the same:

1. In your assistant, add a custom MCP server (sometimes called a “connector” or “tool server”).
2. Set the server URL to the /mcp URL shown on the LLM / Agent Access page.
3. Set the authorization to a bearer token and paste your lstk_… key.
4. Save. Your assistant should now list Logistified’s tools: search and describe_api to look up what it can do, run to do it, whoami, two documentation tools, and two recipe tools (list_skills and get_skill).

Protocol versions. Logistified speaks every current revision of the MCP protocol, from 2024-11-05 through 2025-11-25 and the newer 2026-07-28, on the same address. Your assistant picks the newest one it supports automatically; you never choose. Simple scripts that send plain JSON requests keep working unchanged.

Note

Each assistant has its own way of storing MCP servers (a config file, a settings screen, or a CLI command). Check that app’s own documentation for where to add a custom MCP server with a bearer token; the values to enter are the URL and key above.

Tip

Your assistant may ask before each run. Logistified marks run as a tool that can change data in your store, because with a write key it can. Many assistants therefore ask you to approve each run call, while lookups such as search and describe_api run without asking. Codex, for example, asks every time, and when it runs unattended it skips run unless Logistified’s tools are pre-approved in its settings. Approve the call, or allow Logistified’s tools in your assistant if you trust the key’s scope.

Custom HTTP clients

If you maintain your own HTTP client or script, send a User-Agent that honestly identifies your application and version. For example, replace this illustrative value with your own application’s name and version:

User-Agent: YourInventoryAssistant/1.0

Keep the bearer token and MCP request headers required by your client. An identifying header can help compatibility and diagnosis; it does not guarantee acceptance. Do not pretend to be a browser or another application. If your assistant manages its own headers, use its supported configuration and share its name and version with support if connection fails.

Trying it out

Once connected, ask your assistant a question in plain language, such as “List my open purchase orders.” Behind the scenes it calls the run tool with a short program:

run("return await app.purchaseOrders.list({ status: 'open' });");

If it comes back with your real purchase orders, you’re connected. If it fails, use the response details below before changing your key.

Connection troubleshooting

Ask your client maintainer to check the HTTP status, response Content-Type, and error body together. Logistified answers a wrong or revoked key with 401; a 403 comes from an origin check or the connection layer, not from the key itself.

• An access-denied page or plain-text response before MCP connects: this can be a connection-layer rejection. A denial can also be JSON with an access-denied title or problem description; JSON by itself does not mean Logistified checked your key. Generic HTML or text could also mean a wrong URL or an intermediary error, so retain the actual error details.
• HTTP 401 with Logistified’s JSON {"error":"unauthorized"} response: check the copied URL and bearer-token configuration, and whether the key was revoked. Replace a key only when needed for an actual key problem.
• An MCP error or a tool result saying FORBIDDEN_SCOPE: the connection reached the application, but that action is not permitted by the key or plan. Check the intended action and granted access; do not automatically request a more powerful key. Tool failures can arrive with HTTP 200, so read the result too.

For a persistent connection-layer denial, stop retrying and contact support through your normal support process. Changing keys is not a remedy for that denial. Do not automate repeated attempts or disguise your client to get around it. Share the time, client name/version, status, response type, and a small sanitized error excerpt or response reference ID. Never share the bearer token, authorization header, or store data in diagnostic logs.

See also

• API keys: creating and revoking the key you paste here.
• What the assistant can read: the full list of data it can reach.

Last updated: 4 November 2026