# Credentials and connections

Use each credential only for its declared target and rotate it when exposure is possible.

## Use this when

Use this when connecting an external tool, CI job, MCP client, or Shopify Admin client.

## Before you start

Distinguish the [workspace API key](/help/definitions.html#definition-workspace-api-key) from the [per-store Admin token](/help/definitions.html#definition-store-admin-token). Real credential values must never enter Documentation, receipts, support messages, or logs.

## Steps

- **Workspace API key:** begins `meg_sk_…`, is shown once, and scopes an external control client to one workspace. Put it in `MEGURO_API_TOKEN`.

- **Per-store Admin token:** begins `meg_pw_…`, targets one practice store, and is sent by the agent as `X-Shopify-Access-Token`.

- **Hosted control plane:** OAuth 2.1 remote MCP over stateless Streamable HTTP `/mcp`.

- Without signing in, hosted MCP supports initialization, lists the complete tool catalog, and serves `docs_read`; only `docs_read` is callable without authorization, and all other tools require OAuth.

- **Local alternative:** Meguro MCP over stdio with a workspace API token.

- **Separate shopper plane:** a practice store’s `/api/mcp` endpoint models Storefront shopper interactions and does not replace the control plane.

## Success looks like

The external control client is limited to its workspace, while the agent under test can reach only the intended practice store.

## If it fails

An invalid or revoked workspace key must be replaced in Connection settings. Rotate credentials after possible exposure and update every intended client; never paste Cognito tokens, browser cookies, or browser storage into a terminal.

## Next action

Open [Connection settings](https://app.meguro.io/#settings?section=connection).