How to Connect Claude Code and Desktop MCP Clients with a Token

Desktop and command-line MCP clients (Claude Code, Cursor, custom scripts) don’t use the sign-in flow — they authenticate with a bearer token you create in Linkilo. This is the fastest way to connect, and it works even on hosts where the web sign-in flow is blocked. It works on Linkilo 2.9 and later.

Step 1 — Turn on MCP access

Go to Linkilo → Manage → MCP Access, tick Enable MCP access, then click Save. (Off by default.)

Step 2 — Create a token

1. On the same page, under Issue a new token, enter a Label (e.g. “Claude Code — laptop”).
2. Pick a Role: start with read_only. Only pick editor if you want the assistant to insert links or create redirects — and remember write actions also require the page’s second switch, Allow confirmed write actions, to be on.
3. Pick when it Expires (30 days, 90 days, 1 year or Never; 90 days is the default) and click Create token.
4. Copy the token immediately — it is shown exactly once. If you lose it, revoke it and create a new one.

Step 3 — Add the server to your client

Your endpoint is shown under Connection endpoint on the MCP Access page. For Claude Code, run:

claude mcp add --transport http linkilo https://yoursite.com/wp-json/linkilo-mcp/v1/rpc --header "Authorization: Bearer YOUR_TOKEN_HERE"

For other clients, add a remote MCP server with the same URL and an Authorization: Bearer <token> header.

The two rules that trip people up

• The token never goes in the URL. Not appended, not as a query string, not after a slash. It goes only in the Authorization header.
• Treat the token like a password. Anyone who has it can read your Linkilo data. Don’t paste it into screenshots, chats, or support tickets — if that happens, click Revoke in the Issued tokens table right away (takes effect on the next request).

Verifying it works

Ask the assistant to run the get_connection_status tool. It reports, from the site itself: that you’re authenticated, your token’s role, whether the site is in read-only mode, and whether Google Search Console / GA4 are connected. If that tool answers, the connection is healthy — an empty report elsewhere just means that dataset is empty, not that the connection dropped.

Every call the client makes shows up in the Recent MCP activity table at the bottom of the MCP Access page. Note that MCP reads Linkilo’s stored data only; it never spends the AI provider key saved in AI Settings.

Last reviewed for Linkilo 3.0.0 (October 2026).