How far the AI can go
The AI can only do what the API key allows:
| API key | What the AI can do |
|---|---|
| Account API key (recommended) | Exactly your permissions in each shop: role, warehouses, department, work hours, allowed IPs |
| Shop API key | Full Open API access to that shop |
To let the AI only view data, create the API key from an account that only has view permissions, or grant read access when connecting with OAuth (below).
Read and write
Each business area has separate read and write tools (pos_order and pos_order_write, see Tools). Tools are annotated following the MCP standard:
- Read tools (
readOnlyHint): only view data. Clients may allow them to run automatically. - Write tools: create, edit and cancel data. Some actions cannot be undone, such as placing an automated call to a customer (
pos_auto_voice). Clients are told to ask you before running them.
Keep your client asking for confirmation before every write, and read the parameters the AI is about to send before you agree, especially for bulk actions.
Two ways to authenticate
| Method | Used by | Limits |
|---|---|---|
| OAuth | Claude Desktop (Connectors) and clients that support OAuth: the client opens an authorization page where you paste your API key | The client requests pos:read (read) and/or pos:write (write); the authorization page lists them. The server blocks tools outside the granted access |
Header X-Api-Key |
Claude Code, Codex, Cursor, file-based configs | The API key's full permissions; the MCP server does not split read and write |
With OAuth, the API key is encrypted inside the token the MCP server issues; the client cannot read the original key.
Where data goes
- The MCP server stores no shop data: every call goes straight to the Open API and the result goes back to the client.
- The results (orders, customers, revenue…) are sent by the client to the AI model provider (Anthropic, OpenAI…) under that provider's policies. Think before letting the AI read sensitive customer data.
Revoking access
- Revoke the API key: Account › API Key (account keys) or delete it in Settings › Apps › Webhook/API (shop keys). Every client using that key loses access immediately.
- Remove the server from the client: delete the connector in Claude Desktop, run
claude mcp remove pancake-posin Claude Code, or remove the config block in Codex or Cursor.
Use a separate API key per client so you can revoke them one at a time.