Provider mode

Provider mode is for companies that build AI agents for their own customers. Your product onboards each customer through the Management API. Their people get MCP seats, and your agents reach each customer's CMMS, ERP or fleet system through Makini, with no Makini screens in between.

Direct and provider mode

	Direct mode	Provider mode
Who uses the agents	Your own team	Your customers' people
MCP users and roles	One list for the workspace	Separate for each customer (a tenant)
Company-wide credentials	One set per platform	One set per customer and platform
Platform visibility	One setting per platform	Your default, which each customer can override
How users are added	Invited from the dashboard	Created by your product through the Management API, or from the dashboard

Each tenant is fully isolated. Its users, roles, connections and company-wide credentials are its own, and one customer's settings never affect another's.

Switch to provider mode

Open Settings → Application, find MCP mode, and click Switch to provider mode.

Switching deletes every MCP user, connection and company-wide credential on the application. In provider mode each of them belongs to one of your customers, so they can't carry over. Your roles, tool permissions and platform settings are kept, and your MCP server URL stays the same.

Your application sets the ceiling

The tool permissions you set on Platforms → Permissions apply to every customer. A customer's roles can narrow that ceiling but never widen it, whoever edits them. You decide once what your agents may ever do, and each customer's setup works inside that.

In the dashboard, Tenants lists your customers. Open one to manage its users, roles, platforms, company-wide credentials and connections.

Authenticate

The Tenants API is part of the Management API, under https://api.makini.io/mgmt. Request a token with your application's Client ID and Client Secret, using the client_credentials grant:

The token carries the mcp:provider:manage scope, which covers every route on this page. Tokens last an hour, and a client_credentials response includes no refresh token, so request a new one when it expires. See Access tokens.

Onboard a customer

Create a tenant

externalId is your own ID for the customer, such as your account ID, and it must be unique within your application. name is optional.

{
  "providerTenant": {
    "id": "7f0c1d7e-4b1a-4f3e-9f55-2a8f1c0d9b12",
    "clientId": "<your Client ID>",
    "externalId": "acct_4821",
    "name": "Northwind Utilities",
    "userCount": 0,
    "createdAt": "2026-09-25T10:00:00Z",
    "updatedAt": "2026-09-25T10:00:00Z"
  }
}

Every new tenant comes with a Default role, so you can add users right away.

Add an MCP user

The response is {"mcpUser": {…}} with the user's id, roleId and roleName. Leave out roleId to give the user the tenant's default role.

Each email address belongs to one customer within your application.

Issue a personal access token

A personal access token lets your backend act as that user with no browser sign-in:

{
  "id": "5d1f0c1e-…",
  "token": "eyJhbGciOi...",
  "tokenEndpoint": "https://…/token",
  "agentClientId": "…",
  "resource": "https://mcp.makini.io/<clientId>"
}

See Personal access tokens below for how to use it.

Connect the customer's systems

The customer's user enters their own system credentials through Makini Link. When your agent calls verify_platform_authentication for a platform the user hasn't connected, it gets a Makini Link URL. Show that URL to the user. They open it, sign in to their system once, and the agent carries on.

Set company-wide credentials for the tenant first, and users are asked only for their own sign-in details.

Personal access tokens

The token is a long-lived OAuth refresh token for one MCP user. Makini returns it once and doesn't store it, so keep it in your secret store.

To get an access token, redeem it with a standard refresh_token grant at the tokenEndpoint, using the agentClientId from the same response. No client secret is needed:

Send the resulting access_token as a Bearer token to your MCP server, https://mcp.makini.io/<clientId>, from any MCP client library. Redeem again whenever the access token expires. The refresh token itself doesn't change.

A token works only on your own application's MCP server.

Each call to the tokens route creates a new, separate token, up to ten for each user. The response's id is what you list and revoke it by.

A token that hasn't been used for 90 days stops working.

Disabling or deleting the MCP user stops their tokens at the next redemption. After you enable a person again, issue them a new token.

A disabled user can't be issued a token. Enable them first.

People you provision can also sign in interactively from any MCP client, with a one-time code sent to their email.

Agents

An agent is an MCP user nobody signs in as: a scheduled job or a backend service of yours, working for one customer. It has a name and no email address, and your backend does what a person would do from their agent.

Connect answers {"state": "connected", "connectionId": "…"} when the customer's company-wide credentials cover everything the platform asks for. Otherwise it answers {"state": "absent", "linkAuthorizeUrl": "https://…"}: open that Makini Link URL for whoever holds the credentials the agent should use.

Issue its tokens with the same tokens route as a person's. Three things differ from a person:

An agent only sees platforms that are connected. The others are left out of list_platforms, and it is never given a Makini Link URL.

Disabling an agent pauses it. Its tokens work again when you enable it.

Deleting an agent deletes its connections.

Tenants API reference

All paths are relative to https://api.makini.io/mgmt.

Method and path	What it does
`GET /mcp/tenants`	List your customers, each with its user count.
`POST /mcp/tenants`	Create a customer.
`GET /mcp/tenants/{tenantId}`	Read one customer, with its user, connection and visible-platform counts.
`PUT /mcp/tenants/{tenantId}`	Rename a customer, or change its `externalId`.
`DELETE /mcp/tenants/{tenantId}`	Remove a customer. Delete its MCP users first.
`GET /mcp/tenants/{tenantId}/users`	List a customer's MCP users.
`POST /mcp/tenants/{tenantId}/users`	Add an MCP user, or an agent with `"kind": "agent"`.
`GET /mcp/tenants/{tenantId}/users/{mcpUserId}`	Read one MCP user.
`PUT /mcp/tenants/{tenantId}/users/{mcpUserId}`	Change `email`, `name` or `roleId`, or set `disabled`.
`DELETE /mcp/tenants/{tenantId}/users/{mcpUserId}`	Offboard an MCP user.
`POST /mcp/tenants/{tenantId}/users/{mcpUserId}/tokens`	Issue a personal access token.
`GET /mcp/tenants/{tenantId}/users/{mcpUserId}/tokens`	List a user's tokens, each with when it was created and last used.
`DELETE /mcp/tenants/{tenantId}/users/{mcpUserId}/tokens/{tokenId}`	End one token. The user's other tokens keep working.
`POST /mcp/tenants/{tenantId}/users/{mcpUserId}/platforms/{key}/connect`	Connect a platform for an agent.
`GET /mcp/tenants/{tenantId}/connections`	List a customer's connections.
`GET /mcp/tenants/{tenantId}/roles`	List a customer's roles, each with its user count.
`POST /mcp/tenants/{tenantId}/roles`	Create a role (`name`, and optionally `description` and `isDefault`).
`GET /mcp/tenants/{tenantId}/roles/{roleId}`	Read one role.
`PUT /mcp/tenants/{tenantId}/roles/{roleId}`	Rename a role, or make it the default for new users.
`DELETE /mcp/tenants/{tenantId}/roles/{roleId}`	Delete a role. Pass `?reassignToRoleId=` to move its users in the same step.
`POST /mcp/tenants/{tenantId}/roles/{roleId}/tools/_lookup`	Read a role's tool permissions on a platform, a page at a time.
`PUT /mcp/tenants/{tenantId}/roles/{roleId}/tools`	Enable or disable individual tools for a role.
`PUT /mcp/tenants/{tenantId}/roles/{roleId}/tools/_default`	Enable or disable every tool on a platform for a role.
`GET /mcp/tenants/{tenantId}/platforms`	Read the platforms a customer inherits from your defaults, and its own overrides.
`PUT /mcp/tenants/{tenantId}/platforms/{key}`	Show or hide one platform for a customer.
`GET /mcp/tenants/{tenantId}/platform-credentials`	List the platforms that have company-wide credentials for a customer.
`GET /mcp/tenants/{tenantId}/platforms/{key}/credentials`	Read which company-wide fields a platform takes, and whether they are set.
`PUT /mcp/tenants/{tenantId}/platforms/{key}/credentials`	Set a customer's company-wide credentials for a platform.
`DELETE /mcp/tenants/{tenantId}/platforms/{key}/credentials`	Stop supplying them.

The full request and response schemas are in the Management API reference.

Tool permissions for a customer's role

Set a platform-wide default, then list exceptions a page at a time. In tools, name the tools you are deciding on (up to 200 per call). In disabled, list the ones among them that should be off:

Changing the default clears that role's exceptions on the platform. "defaultEnabled": null returns the role to inheriting. _lookup reports each tool's own setting and its effective state once your application ceiling applies. Take tool names from _lookup or from the agent's search_platform_tools.

Platform visibility for a customer

true or false overrides your default for this customer, and the override stays in place if you later change the default. null removes the override.

Company-wide credentials for a customer

GET …/platforms/{key}/credentials returns the fields the platform takes company-wide and the number of the customer's connections that use it. Send values for those fields:

Saving updates this customer's existing connections to the platform. Stored values are never returned. Reads give back field names and whether each one is set.

Errors

The Tenants API uses the standard Makini error body, {code, message}. The ones you'll handle most:

Status	When
`404`	The tenant, user or role doesn't exist or isn't one of yours.
`409`	The application is in direct mode; the `externalId` or email address is already in use; a tenant still has users; a role still has users and no `reassignToRoleId`; the MCP user is disabled, or already has ten tokens, when you issue a token; you call connect for a person.
`502`	A service behind the request didn't answer. Retry.

Direct and provider mode#

Switch to provider mode#

Your application sets the ceiling#

Authenticate#

Onboard a customer#

Personal access tokens#

Agents#

Tenants API reference#

Tool permissions for a customer's role#

Platform visibility for a customer#

Company-wide credentials for a customer#

Errors#

Direct and provider mode

Switch to provider mode

Your application sets the ceiling

Authenticate

Onboard a customer

Personal access tokens

Agents

Tenants API reference

Tool permissions for a customer's role

Platform visibility for a customer

Company-wide credentials for a customer

Errors