Skip to main content
woku exposes an MCP server (Model Context Protocol) so an AI agent can query your company data without a browser in the middle: wokus, NPS, CSAT, and CES metrics, form responses, action plans, and more, directly from the conversation. It is the same engine the admin panel drives: every tool runs the exact command or query the panel runs, so the two surfaces cannot grow two behaviours.
Authentication is OAuth 2.1. You connect by signing in to woku in your browser and approving a consent screen; there is no key to create or paste. That is what lets browser assistants (Claude, ChatGPT) connect, not only coding agents. tools/list on a live connection is always the authoritative answer about what the server offers.

​
The endpoint

  • Transport: Streamable HTTP.
  • Server name: woku.
  • Stateless by design. GET and DELETE answer 405: there is no server-initiated stream and no session to terminate, so advertising either would be advertising a capability that does not exist.
  • No API keys. Authentication uses OAuth and the client discovers the flow on its own; you only approve access from your woku account.

​
Authentication

Access is approved from your session in the admin panel, never by sharing your password or an API key with the agent.
  • OAuth 2.1 with mandatory PKCE. The client discovers the authorization and token endpoints on its own and completes the flow in the browser.
  • Explicit consent. You choose the company you want to connect on the consent screen; the connection stays bound to that company.
  • Bounded lifetimes. The authorization code lasts 10 minutes, the access token 1 hour, and the refresh token 30 days. Renewal is automatic while you use the connection.

​
One connection, one company

Each connection is bound to a single company: the agent only sees the data of the company you approved on the consent screen. If you belong to several companies and want to query them all, create one connection per company.

​
Scopes gate tools

Connections handle two permissions: mcp:read to query data and mcp:write for the tools that create or modify. If the connection does not have mcp:write, the write tools respond with an error indicating so and the rest keep working normally. Which tool is read or write is listed in Tools.

​
Managing and revoking connections

  • Membership verified on every renewal. When the token is renewed, it is checked that you are still a member of the company. If you are removed from the company, the connection stops working when the access token expires, within 1 hour at most.
  • Revocation from the client. You can remove the connector in your client at any time to cut off access.
To connect a client step by step, see Connecting a client.