Connect an AI assistant to your company
https://x7.ee/mcp and the header Authorization: Bearer your_key. Anything irreversible happens only after you confirm it.
- The "API and MCP keys" permission, granted by the company owner in role settings
- An AI application that can connect to external data sources
What this actually is
Modern AI assistants can do more than talk — they can work with your software. For an assistant to look into X7, it needs access, much like a colleague you create an account for.
The way it connects is called MCP. You do not need to remember the name: for you it is an address and a key that you enter once into the application's settings. After that the assistant works out for itself what your X7 can do.
Once connected, a conversation looks like this:
— Which clients have not paid on time?
— Three invoices are overdue: OÜ Näidis for €1,240, due on 12 September…— Give Marina a task: prepare the handover document for this project, by Friday.
— Done, task PRJ-412 created and assigned.
What the assistant can do
It depends on the permissions you tick when creating the key:
- reading — clients, invoices, expenses, projects and tasks, stock, the knowledge base, the inbox, the audit log;
- creating and editing — tasks, projects, clients, products and services, expenses, knowledge base articles, invoices;
- invoice actions — mark as paid, cancel, email to the client;
- inbox — assign to a colleague, reply, archive.
Quotes, company settings and team management are not available to the assistant yet — those stay manual.
What the assistant cannot do
A key never grants more than you have. If you cannot see expenses in the cabinet, neither can the assistant, even if that permission was ticked by accident. The key's permissions are intersected with your live permissions on every call.
You can tick less than you have, and you should. A key meant for sorting out tasks has no business being able to delete clients. If the assistant ever behaves oddly, the damage is bounded by what you ticked.
Irreversible actions need confirmation. The assistant describes the consequences first and waits. You will not see "delete record 412" but "remove the €1,240 invoice billed to OÜ Näidis".
Steps
Create a key
Open the keys section and create one.
Open API and MCP keys- Type — MCP. The API type is for programs calling ordinary web addresses; an assistant needs MCP.
- Name — this is how you will recognise the key later. "Claude on the work laptop" beats "key 1".
- Permissions — tick only what is needed. You are shown the permissions you currently hold.
- Confirming irreversible operations — leave it on Ask first.
Copy the key
X7 shows a long string starting with x7m_ exactly once.
Warning
The key is shown once and never again. Close the page and it is gone; you will have to create a new one. Keep it like a password: within the ticked permissions it is equal to your password.
Connect it in your application
Everywhere you need the same three things — only the place and the spelling differ:
- address:
https://x7.ee/mcp - connection type: HTTP
- header:
Authorization: Bearer your_key
If the application has no field for a header and only offers an “API key” field, any of these headers will do — X7 accepts them alongside Authorization, and case does not matter:
X-Api-Key, X-Api-Token, X-Auth-Token, Api-Key, Api-Token, ApiKey.
Into such a field goes the key itself, without the word Bearer (though it works with it too).
Tip
Where the application can read an environment variable, keep the key there rather than in the file. Then the configuration file is safe to show and to commit.
Claude Code. A command in the terminal:
claude mcp add --transport http x7 https://x7.ee/mcp \
--header "Authorization: Bearer YOUR_KEY"Or the same as a file — ~/.claude.json, or .mcp.json in the project root to share it with the team:
{
"mcpServers": {
"x7": {
"type": "http",
"url": "https://x7.ee/mcp",
"headers": { "Authorization": "Bearer YOUR_KEY" }
}
}
}Warning
That command stores the key in your shell history and in the session log. If you share your screen, send logs anywhere, or work on a shared machine, put the key in a file instead of the command line. Already used the command? Revoke the key and issue a new one.
Codex, the ChatGPT desktop app and the Codex extension for VS Code. They share one file, ~/.codex/config.toml (on Windows C:\Users\Name\.codex\config.toml): set it up once and it works in all three.
[mcp_servers.x7]
url = "https://x7.ee/mcp"
http_headers = { "Authorization" = "Bearer YOUR_KEY" }Safer — keep the key in an environment variable, so only its name is in the file:
[mcp_servers.x7]
url = "https://x7.ee/mcp"
env_http_headers = { "Authorization" = "X7_KEY" }There is no codex mcp add with a header flag — the file is the only way.
Cursor. File ~/.cursor/mcp.json (for every project) or .cursor/mcp.json in the project root:
{
"mcpServers": {
"x7": {
"url": "https://x7.ee/mcp",
"headers": { "Authorization": "Bearer ${env:X7_KEY}" }
}
}
}${env:X7_KEY} substitutes the environment variable, so the key never lands in the file.
VS Code with Copilot. The easiest way is the command palette: MCP: Add Server, choose HTTP and give the address. By hand it is .vscode/mcp.json — and note that the section is called servers, not mcpServers:
{
"servers": {
"x7": {
"type": "http",
"url": "https://x7.ee/mcp",
"headers": { "Authorization": "Bearer ${input:x7-key}" }
}
}
}Antigravity. The ellipsis menu above the agent panel → MCP Servers → Manage MCP Servers → View raw config. The file is ~/.gemini/config/mcp_config.json, or .agents/mcp_config.json in the project. Here the address field is called serverUrl, and that is not a typo: this application does not understand url or httpUrl.
{
"mcpServers": {
"x7": {
"serverUrl": "https://x7.ee/mcp",
"headers": { "Authorization": "Bearer YOUR_KEY" }
}
}
}The Claude desktop app. The documentation shows no settings dialog for adding your own server with a header. Connect through Claude Code or through an .mcp.json file as above.
Any other application. Look in its settings for "MCP", "connectors", "external sources" or "integrations" and enter the same three values. If there is no field for a header at all, the application only supports OAuth sign-in and our key will not fit it.
Check that it works
Ask the assistant something simple:
Check the X7 connection — whose account and which company are you working in?
It should answer with your name and your company's name. If it does, you are done.
Ask or do not ask: which to choose
Ask first (recommended). Before every irreversible action the assistant shows what it is about to do and waits. Works with every application.
Do not ask. The server acts immediately. That does not mean nobody asks — many applications ask on their own — but that depends on their settings rather than ours. Choose this only for automation where no human is expected to be present.
Note
Neither the mode nor the permission list of an issued key can be changed. Changed your mind? Revoke it and create a new one. This is deliberate: a key whose permissions could be quietly widened would guarantee nothing.
If something is wrong
The assistant cannot see X7. Check the address and the key. Paste the key whole, including the leading x7m_, with no stray spaces.
The action you need is missing. The assistant only sees what the key is allowed to do. Create a new key with the right permissions.
It used to work and now returns an access error. That happens when a permission was taken away from you in the company, or a module's subscription ended: the key loses access along with you.
New features did not appear after an X7 update. The application remembers the list of actions from the moment it connected. Reconnect the server — in Claude Code that is the /mcp command.
How to revoke access
In the same section every key has a revoke button. A revoked key stops working immediately.
Revoke without hesitation if you changed computers, stopped using the assistant, or the key could have ended up somewhere it should not — a chat, a screenshot, someone else's hands. Creating a new one takes half a minute.
More about roles and permissionsFrequently asked questions
Will the assistant see all of the company's data?
Only what you ticked when creating the key, and only within your own permissions. A key can never do more than you can, and it loses access the moment you do.
What if the assistant makes a mistake and deletes something?
Irreversible actions — deleting, archiving, emailing a client — require confirmation. The assistant first shows exactly what it is about to do and waits for your answer.
Can somebody else use my key?
Only you see and revoke your own keys. Even a colleague with wider permissions will not find your key in their list. If a key leaks anywhere, revoke it and it stops working immediately.
Does this cost extra?
Not on the X7 side — keys are part of your subscription. The assistant's own application may charge you, but that is not up to us.
Will the assistant email an invoice to a client without asking?
No. Sending is the most carefully guarded action: the assistant must show the recipient address, the invoice number and the amount, and only then does the email go out. A sent email cannot be recalled, which is why you are asked twice.
What is the difference between an MCP key and an API key?
They are two different ways to connect. MCP is for AI assistants, which discover on their own what your X7 can do. API is for ordinary programs that call web addresses and know in advance what they are asking for. A key works only in its own channel.
Related guides
First month free.