Desktop and command-line clients connect to Linkilo in one of two ways. From Linkilo 3.0.2, Claude Code and other apps built on the official MCP kit can sign in through the browser, exactly like the web connectors, with no key to copy. Apps and scripts that need a fixed credential (Cursor, Gemini CLI, the Grok or Gemini APIs, your own code) use a key you create on the MCP Access page.
Both need access turned on first: Linkilo → Manage → MCP Access, tick Allow AI assistants to connect, click Turn on.
Claude Code: sign in through the browser (recommended)
- On the MCP Access page, pick Claude Code under Pick your assistant. It shows this command with your own address filled in and a copy button:
claude mcp add --transport http linkilo https://yoursite.com/wp-json/linkilo-mcp/v1/rpc - Run it in a terminal.
- Start Claude Code, type
/mcp, pick linkilo and choose Authenticate. Your browser opens your site’s approval screen: sign in to WordPress if asked, choose the access level and click Approve. - Claude Code returns to a local address on a random port. Linkilo accepts that, and the approval screen tells you when a connection is returning to a program on your own computer, so only approve one you just started yourself.
The connection then appears under Connected assistants and keys like any other, with the level and expiry you chose, and can be disconnected there.
Because Claude Code falls back to backup sign-in addresses on your site (/register, /authorize, /token), this works even on hosts that block /.well-known/ discovery; the sign-in check on the MCP Access page shows Claude ready in that case.
Other apps: create a key
For a server, CI, or a client that cannot open a browser:
- On the MCP Access page, pick Other apps.
- Under Create key: name it (for example “Cursor on my laptop”), choose What it may do (View only, Draft only or Publish) and, for Draft or Publish, the areas it may change, choose when it Expires (30 days, 90 days, 1 year or Never), and click Create key.
- Copy your key now. It will not be shown again. If you lose it, disconnect it and create a new one.
- Add the server to your client with the connection address and the header
Authorization: Bearer YOUR_KEY. For Claude Code without a browser:claude mcp add --transport http linkilo https://yoursite.com/wp-json/linkilo-mcp/v1/rpc --header "Authorization: Bearer YOUR_KEY"The setup screen shows a typical configuration block for other clients.
The two rules that trip people up
- The key never goes in the URL. Not appended, not as a query string. It goes only in the Authorization header.
- Treat the key like a password. Anyone who has it can read your Linkilo data at the level you gave it. Don’t paste it into screenshots, chats or support tickets; if that happens, click Disconnect in the connections table and it stops working on the next request.
Verifying it works
Ask the assistant to run the get_connection_status tool. It reports, from the site itself: that you are authenticated, the connection’s access level and areas, whether changes are allowed on the site, and whether Google Search Console and GA4 are connected. If that tool answers, the connection is healthy. An empty report elsewhere means that dataset is empty, not that the connection dropped.
Every call shows up in Recent MCP activity at the bottom of the MCP Access page. MCP reads Linkilo’s stored data only; it never spends the AI provider key saved in AI Settings.
Upgrading from 3.0.1 or earlier
Tokens you created before 3.0.2 keep working. Their old roles are mapped so nothing gains access: read_only is now View only, read_write is Draft only (its content changes now wait for approval), editor and admin are Publish with all areas. You can change any of them in the connections table.
Last reviewed for Linkilo 3.0.2 (October 2026).