How it works
MCP works through a client-server architecture. CommissionKit acts as the MCP server, and your AI assistant (Claude Desktop, Cursor, VS Code, etc.) acts as the MCP client. Each request is authenticated with a workspace-scoped API key. Permissions are enforced per tool, and all actions are attributed to the API key’s creator in the audit log.Prerequisites
- A CommissionKit workspace with admin access
- An API key with the appropriate permissions
Step 1: Create an API key
- Go to Settings → API Keys
- Click Create API Key
- Give your key a name (e.g., “Claude Desktop”, “Development”)
Selecting permissions
You can scope your API key to specific tools:
For AI assistants that only need to view data,
read:all is sufficient. For assistants that will create or modify data, add the corresponding write permissions.
- Copy the generated key — it is only shown once
Step 2: Configure your AI assistant
Claude Desktop
Add this to your Claude Desktop configuration file (claude_desktop_config.json):
YOUR_API_KEY with the key you created in Step 1.
Cursor
In Cursor, go to Settings → Features → MCP Servers and add:- Name:
commissionkit - Type:
url - URL:
https://app.commissionkit.co/api/mcp - Headers:
{ "Authorization": "Bearer YOUR_API_KEY" }
VS Code (with MCP extension)
In your VS Code settings (settings.json):
Any MCP-compatible client
Point your MCP client to:Available tools
Deals
Constrained fields:
Reps
Commission Runs
Constrained fields:
Payouts
Constrained fields:
Disputes
Constrained fields:
Dashboard
Audit trail
Every action performed through the MCP server is recorded in the audit log. The audit events show:- User:
MCP {api_key_name}(e.g.,MCP Claude Desktop) - User email: Email of the person who created the API key
- Action: The specific action performed
- Resource: The affected resource (deal, rep, run, etc.)
- Changes: Before/after values for updates
Security considerations
- API keys are hashed with SHA-256 before storage — CommissionKit cannot retrieve the raw key after creation
- Each API key can be revoked independently from the Settings page
- Permissions are granular — you can create read-only keys for assistants that should only view data
- Invalid or expired keys are rejected immediately with a descriptive error
- All MCP requests are rate-limited and logged
Troubleshooting
”Invalid API key format”
Ensure your key starts withck_. Keys follow the format ck_<base64url> and are generated from the API Keys settings page.