Skip to main content
The Salesfinity MCP server works with any client that supports the Model Context Protocol over Streamable HTTP. Clients sign in with OAuth, or send an API key in a header if they cannot run a browser sign-in.

​
Server details

An unauthenticated request to /mcp gets 401 with a WWW-Authenticate header pointing at the protected-resource metadata, so a client that supports MCP authorization discovers the rest by itself. The sign-in page asks for a Salesfinity API key, which you create under Settings → Connections → API & Webhooks. The server closes a session after 30 minutes without a request. A request on a closed session fails with Bad Request: Server not initialized; reconnect the server in your client to start a new session.

​
Cursor

Add the server to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json to use it in every project:
When Cursor connects, complete the Salesfinity sign-in with your API key. If your Cursor setup does not offer the sign-in, use header authentication instead.

​
Windsurf

Add the server to Windsurf’s MCP configuration file, mcp_config.json, using serverUrl for the address. Windsurf’s MCP documentation gives the file’s location on your system.

​
Generic MCP client

For any other MCP client, use these connection details:
  • Transport type: Streamable HTTP
  • Endpoint: https://mcp.salesfinity.ai/mcp
  • Auth: OAuth 2.0, discovered from /.well-known/oauth-authorization-server. On first connection the sign-in page asks for your Salesfinity API key.
Client configuration varies, so check your client’s documentation for the exact format. The server URL and transport are the same for every client.

​
Header authentication

A client that cannot run a browser sign-in, such as a script or a hosted agent, can send the API key itself in an x-api-key header on every request to /mcp. In a client that takes a headers map, such as Cursor:
The key then lives in your client’s configuration, so read it from an environment variable where the client supports one, as above, and keep the file out of version control. A request that carries an Authorization: Bearer header is authenticated by that header alone, and x-api-key is ignored.

​
Next steps

Browse use cases

Ready-to-paste prompts for managers, reps and everyone else.

See every tool

What each tool reads or changes, and the API operation behind it.