Skip to main content
CommissionKit supports the Model Context Protocol (MCP), an open standard that lets AI assistants interact with your workspace data directly. Once connected, AI assistants can query deals, reps, commission runs, payouts, and more — all scoped to your workspace.

How it works

MCP works through a client-server architecture. CommissionKit acts as the MCP server, and your AI assistant (Claude Desktop, Cursor, VS Code, etc.) acts as the MCP client. Each request is authenticated with a workspace-scoped API key. Permissions are enforced per tool, and all actions are attributed to the API key’s creator in the audit log.

Prerequisites

  • A CommissionKit workspace with admin access
  • An API key with the appropriate permissions

Step 1: Create an API key

  1. Go to SettingsAPI Keys
  2. Click Create API Key
  3. Give your key a name (e.g., “Claude Desktop”, “Development”)

Selecting permissions

You can scope your API key to specific tools: For AI assistants that only need to view data, read:all is sufficient. For assistants that will create or modify data, add the corresponding write permissions.
  1. Copy the generated key — it is only shown once

Step 2: Configure your AI assistant

Claude Desktop

Add this to your Claude Desktop configuration file (claude_desktop_config.json):
Replace YOUR_API_KEY with the key you created in Step 1.

Cursor

In Cursor, go to SettingsFeaturesMCP Servers and add:
  • Name: commissionkit
  • Type: url
  • URL: https://app.commissionkit.co/api/mcp
  • Headers: { "Authorization": "Bearer YOUR_API_KEY" }

VS Code (with MCP extension)

In your VS Code settings (settings.json):

Any MCP-compatible client

Point your MCP client to:

Available tools

Deals

Constrained fields:

Reps

Commission Runs

Constrained fields:

Payouts

Constrained fields:

Disputes

Constrained fields:

Dashboard

Audit trail

Every action performed through the MCP server is recorded in the audit log. The audit events show:
  • User: MCP {api_key_name} (e.g., MCP Claude Desktop)
  • User email: Email of the person who created the API key
  • Action: The specific action performed
  • Resource: The affected resource (deal, rep, run, etc.)
  • Changes: Before/after values for updates
This means you can always trace which API key and which AI assistant performed an operation.

Security considerations

  • API keys are hashed with SHA-256 before storage — CommissionKit cannot retrieve the raw key after creation
  • Each API key can be revoked independently from the Settings page
  • Permissions are granular — you can create read-only keys for assistants that should only view data
  • Invalid or expired keys are rejected immediately with a descriptive error
  • All MCP requests are rate-limited and logged

Troubleshooting

”Invalid API key format”

Ensure your key starts with ck_. Keys follow the format ck_<base64url> and are generated from the API Keys settings page.

”Permission denied”

Your API key does not have the required permission for the tool you are trying to use. Create a new key with the appropriate permissions, or update the existing key’s permissions from the API Keys settings page.

”Session not found”

MCP sessions expire after a period of inactivity. The AI assistant will automatically create a new session on the next request.