# Auth.md: Connect to HitKeep

The public website at https://hitkeep.com needs no sign-in. Choose your Cloud region before creating an account: [EU (Frankfurt)](https://cloud.hitkeep.eu/signup?utm_source=hitkeep_docs&utm_medium=website&utm_campaign=eu_cloud&utm_content=auth_md) or [US (Virginia)](https://cloud.hitkeep.com/signup?utm_source=hitkeep_docs&utm_medium=website&utm_campaign=us_cloud&utm_content=auth_md). Accounts and authorization belong to the selected regional instance.

Sign in on your instance's ordinary login page. An external assistant uses Authorization Code with PKCE S256, a supported public client ID and explicit OAuth consent on that instance. Use the exact resource advertised for the job: the MCP resource for read-only analytics, or the API resource for delegated REST actions and A2A analytics. A token for one resource cannot be reused on the other. Never send a password or token to this website or put it in a prompt; keep credentials in the client's secure store. MCP and A2A do not accept dashboard cookies.

Discover each region's real authorization server and protected resource:

- EU: [authorization server](https://cloud.hitkeep.eu/.well-known/oauth-authorization-server), [API protected resource](https://cloud.hitkeep.eu/.well-known/oauth-protected-resource/api), [MCP protected resource](https://cloud.hitkeep.eu/.well-known/oauth-protected-resource/mcp), [MCP card](https://cloud.hitkeep.eu/mcp/server-card).
- US: [authorization server](https://cloud.hitkeep.com/.well-known/oauth-authorization-server), [API protected resource](https://cloud.hitkeep.com/.well-known/oauth-protected-resource/api), [MCP protected resource](https://cloud.hitkeep.com/.well-known/oauth-protected-resource/mcp), [MCP card](https://cloud.hitkeep.com/mcp/server-card).

For MCP analytics, approve `sites:read analytics:read` for one team and explicitly selected sites. Existing scoped API-client bearer tokens remain an alternative for compatible read-only MCP clients. MCP and A2A remain read-only, aggregate-only analytics surfaces; neither exposes application writes or billing actions.

For external-assistant actions, discover ordinary REST operations marked `x-hitkeep-oauth-scope` in the actual instance's `/openapi.json` and request the API resource with only the needed scope:

- `goals:write`: create, update or delete goals and funnels on consented sites.
- `annotations:write`: create, update or delete timeline annotations on consented sites.
- `sites:write`: change domain and retention, and read, create or delete traffic exclusions on consented sites; no site creation, deletion, reset or transfer.
- `opportunities:write`: request generation and update saved Opportunity status on consented sites, subject to normal feature availability.
- `billing:write`: operate configured ACP/UCP checkout sessions for the consented team with current billing administration.

These action scopes require AI Enabled, independently of model provider configuration or Ask AI. Consent selects one team and explicit sites for site operations. Billing-only consent selects a team without requiring sites; mixed billing and site scopes still require explicit site selection. The grant remains bound to that team when the dashboard's active team changes. Every request intersects the grant with current membership, site ownership and user permissions. Review or revoke the grant through the header user menu's Connected applications; revocation and current authority also apply before replaying a saved checkout result.

An external assistant with `billing:write` can initiate a configured Cloud ACP/UCP checkout and return `continue_url` for the user to approve payment in hosted Stripe Checkout. A complete-and-paid provider session is required for `completed`; calling `/complete` or following a return URL does not pay or prove payment. API-client tokens and analytics-only OAuth grants do not authorize billing. MPP/x402 settlement is unavailable: no payment challenge or receipt is issued. WebBotAuth signing and verification are also unavailable; actual signing keys, public verification metadata, request verification and key rotation would be required, and would not replace OAuth consent.

The bounded action scopes do not authorize credentials, impersonation, account security, team/user or instance administration, raw hits, realtime streams, imports, exports, reports, QR campaigns, sharing or webhook administration. Use the ordinary authorized product workflows for those jobs.

These are ordinary sign-in and OAuth instructions, not an agent identity-registration API. Availability depends on the instance's version and configuration; these links do not prove that every optional protocol is deployed. The website's Poppy profile supports ordinary public browsing only, without Poppy sessions or grants. Public discovery and skill installation grant no analytics access or purchase authority. See the [OAuth guide](https://hitkeep.com/guides/security/oauth/) and [MCP setup and checkout limits](https://hitkeep.com/guides/integrations/mcp/).