--- title: "HitKeep 2.15.0: Scoped Assistant Connections and OAuth | HitKeep" description: "Connect assistants and WordPress with explicit site consent, manage OAuth clients, and find your way around HitKeep's reorganized navigation." canonical: "https://hitkeep.com/blog/hitkeep-2-15-0/" --- [← All posts](https://hitkeep.com/blog/) # HitKeep 2.15.0: Scoped Assistant Connections and OAuth Published October 25, 2026·[Pascale Beier, HitKeep maintainer](https://github.com/pascalebeier)·8 min read ![HitKeep Assistants page showing the MCP endpoint and setup links for Claude, ChatGPT, and Codex](https://hitkeep.com/_astro/mcp.DtQD81jG_Z29RaME.webp) *Screenshots show the current HitKeep interface. Feature descriptions refer to this release.* HitKeep 2.15.0 brings scoped assistant connections, OAuth client administration, and a reorganized dashboard. Sign in to HitKeep, choose one team and the sites an integration may use, then approve its requested permissions. Review or revoke that access later in Connected applications. **Release availability:** HitKeep 2.15.0 is now available. [Read the release notes and download it](https://github.com/HitKeep/hitkeep/releases/tag/v2.15.0). OAuth setup also depends on your instance configuration and the connecting client’s support. See [how to check instance support](https://hitkeep.com/guides/security/oauth/#check-instance-support). The screenshots use demonstration data from the current interface. ## Set up an assistant for selected sites Open **Integration → Assistants** to find your instance’s MCP endpoint and setup links for Claude, ChatGPT, and Codex. Add that endpoint as a custom connection in your assistant, sign in to HitKeep, and review the requested site access. A configured endpoint is setup information; the page does not claim that an assistant has connected successfully. Updated public discovery helps compatible clients locate integration endpoints and the canonical analytics skills. Available analytics tools still depend on the configured instance and the sites your connection may access. ![Assistants setup with an MCP endpoint, client setup links, and links to review connected applications](https://hitkeep.com/_astro/mcp.DtQD81jG_Z29RaME.webp) Copy the endpoint for your own instance, then complete the connection in your assistant. The [first-party assistant plugin 2.15.0](https://github.com/HitKeep/hitkeep-assistant-plugins/releases/tag/v2.15.0) is available for Claude, ChatGPT, and Codex. It supplies five analytics skills for general analysis, traffic diagnosis, AI visibility, ecommerce, and tracking verification. Installing these skills is separate from connecting your instance and approving access; it does not imply approval in a public plugin directory. ### Install in Claude For Claude Code, add the first-party marketplace and install the analytics plugin: ``` claude plugin marketplace add HitKeep/hitkeep-assistant-plugins claude plugin install hitkeep-analytics@hitkeep ``` In Claude on the web, download the [HitKeep Analytics 2.15.0 ZIP](https://github.com/HitKeep/hitkeep-assistant-plugins/releases/download/v2.15.0/hitkeep-analytics-2.15.0.zip), then open **Settings → Plugins → Add → Upload plugin → Choose ZIP → Upload**. Review the package’s five skills before using it. ### Install in ChatGPT Download the [same published plugin ZIP](https://github.com/HitKeep/hitkeep-assistant-plugins/releases/download/v2.15.0/hitkeep-analytics-2.15.0.zip). In ChatGPT, open **Settings → Plugins → Browse catalog → Add → Upload plugin archive**, select the ZIP, and choose **Add plugin**. Review **HitKeep Analytics 2.15.0** and its five skills, then choose **Install plugin**. The installed detail offers **Manage** and **Try in chat**. This is a private archive installation. It does not require a public directory listing, and it does not establish an MCP connection. The [plugin release](https://github.com/HitKeep/hitkeep-assistant-plugins/releases/tag/v2.15.0) includes `checksums.txt` for checking the download. ### Install in Codex Add the versioned marketplace and install the same analytics pack: ``` codex plugin marketplace add HitKeep/hitkeep-assistant-plugins --ref v2.15.0 codex plugin add hitkeep-analytics@hitkeep ``` ### Connect your chosen HitKeep instance 1. Choose your instance: [EU Cloud](https://cloud.hitkeep.eu/), [US Cloud](https://cloud.hitkeep.com/), or your self-hosted instance’s canonical public HTTPS URL. Open **Integration → Assistants** there and copy its configured MCP endpoint, including any path prefix. 2. In Claude on the web, open **Settings → Connectors → Add → Add custom connector** and enter the copied HTTPS MCP URL. In ChatGPT, open **Plugins → Add → Add custom MCP server**, enter a name and the server URL, and use **OAuth** where supported. Start sign-in where both your instance and client support it. Plugin installation alone does not configure the endpoint or sign you in. 3. In HitKeep, choose one team and the specific sites to share. Review the requested `sites:read analytics:read` scopes and MCP resource, then approve the connection. Your current site permissions still apply. 4. Return to the assistant and try a bounded question, such as: “Compare my site’s last seven complete days with the preceding seven. What changed, and what remains uncertain?” Check that the answer names the site and reporting period. Review or revoke the grant later through the header user menu’s **Connected applications**. For clients without OAuth support, use a dedicated [API-client token](https://hitkeep.com/guides/security/api-clients/) with explicit site grants where the client supports bearer authentication. The [MCP guide](https://hitkeep.com/guides/integrations/mcp/) and [installation guide](https://hitkeep.com/guides/integrations/hitkeep-agent-skills/) cover the alternatives. External assistant connections remain separate from HitKeep’s internal **Ask AI** and its model-provider configuration. For complete client setup, follow the [Claude guide](https://hitkeep.com/guides/integrations/claude/), [ChatGPT guide](https://hitkeep.com/guides/integrations/chatgpt/), or [Codex guide](https://hitkeep.com/guides/integrations/codex/). The dedicated [Claude analytics](https://hitkeep.com/use-cases/claude-web-analytics/), [ChatGPT analytics](https://hitkeep.com/use-cases/chatgpt-web-analytics/), and [Codex analytics](https://hitkeep.com/use-cases/codex-web-analytics/) pages show the reporting workflows and access boundary. ## Connect with explicit consent OAuth authorization uses your normal HitKeep login. Signup, email verification, SSO, and MFA can continue a pending connection, but signing in does not approve it. Consent is a separate step. Each grant names one team, explicitly selected sites, scopes, and a resource. A reporting assistant can request aggregate analytics access; an integration sending server-side events needs ingest permission. Both remain subject to your current site permissions. Removing your underlying access prevents the integration from retaining it. API and MCP access use different resource audiences. An API token issued through OAuth cannot be reused on MCP, and an MCP OAuth token cannot be reused on the API. Custom tracking domains remain for browser tracking; integration authorization, refreshes, and server-side events use the canonical HTTPS HitKeep instance. ## Register an OAuth client for your team Team owners and administrators with `team.manage_api_clients` can open **Integration → OAuth clients** at `/integration/oauth-clients`. Give the application a name, optionally add its public HTTPS website, and register its exact HTTPS callback URLs. HitKeep generates an immutable public client ID. ![OAuth client details dialog with its public client ID and exact HTTPS callback URL](https://hitkeep.com/_astro/oauth-client-details.CLVkA2MV_Z10MxL8.webp) Select a client row to review its registration, then choose Edit to open the form. These clients use Authorization Code with PKCE S256. There is no client secret to create, copy, or embed in an application. Registration alone grants no analytics access: each user still approves the team’s sites and requested scopes. Saving an edit invalidates the registration’s existing grants and pending consent. Users must start a new authorization after an edit. Revoking a registration prevents new authorizations and revokes its existing grants. Operator-configured clients and clients using public HTTPS Client ID Metadata Documents remain separate registration paths. ## Review your connected applications Open the user menu in the header and choose **Connected applications** to list the OAuth connections you personally approved. Select an application row to open its details dialog, review the team, sites, scopes, and resource, then disconnect any grant you no longer need. ![Connected application details dialog for reviewing personal OAuth access and disconnecting an application](https://hitkeep.com/_astro/oauth-application-details.Dff9osOA_ZxrMMP.webp) Connected applications manages your own approved access; OAuth clients manages the team’s application registrations. Manual API-client tokens remain available for scripts, unattended jobs, and clients without OAuth support. Personal and team API clients keep their existing ownership and explicit site grants. Upgrading does not require replacing those tokens. ## WordPress connects without a pasted token The OAuth-capable HitKeep WordPress plugin lets you choose EU Cloud, US Cloud, or your canonical self-hosted instance, then choose **Connect with HitKeep**. Approve the requested sites and permissions in HitKeep, return to WordPress, select the authorized site and eligible tracking endpoint, and save. ![HitKeep WordPress settings before authorization, showing instance selection, Connect with HitKeep, and tracking and privacy switches](https://hitkeep.com/_astro/wordpress-plugin-settings.DVKW0TH3_1XQOkb.webp) Choose your instance and connect before selecting an authorized site. Credentials stay server-side. WordPress publishes a client metadata document, so the connection needs public HTTPS URLs on both sides. Existing saved browser and server-ingest settings survive upgrades and failed or cancelled authorizations. A successful OAuth connection replaces the previous credential; disconnecting explicitly revokes and clears it. Tracking switches, including Do Not Track choices, retain their saved values. Optional redirect tracking uses the selected site’s ingest grant and current `site.manage_data` authority. The browser tracker still measures human visits; recording AI crawler fetches requires server-side forwarding. ## Connect an assistant without expanding MCP’s boundary OAuth-capable MCP clients can request `sites:read analytics:read` for the configured HTTPS MCP URL and selected sites. MCP stays optional, read-only, aggregate-only, and leader-only. OAuth adds a connection method; it does not add administration, write tools, billing, or raw exports. Protocol support does not imply a Claude or ChatGPT marketplace listing. ## Find analytics and integrations in the updated navigation The sidebar now groups analytics, integrations, account controls, and administration. **Ask AI** remains directly available in the sidebar. Use **Integration → API** for personal API clients, **Integration → OAuth clients** for team application registrations, and the header user menu for your personal **Connected applications**. Team API clients remain under **Administration → Team → API clients**. ## Smaller fixes and maintenance - **OAuth management details:** Client registrations and personal grants use consistent details dialogs for reviewing a registration before editing it and checking approved access before revocation. The screenshots above show both flows. - **MCP OAuth hardening:** Resource and scope checks, refresh and revocation behavior, and current-permission limits remain part of the connection boundary. Assistant access stays read-only and aggregate-only. - **Localized export labels:** Export format labels follow the active language after translation files finish loading and when you switch languages. - **Compatible dependency updates:** Frontend and backend dependencies are refreshed while preserving the single Go binary with embedded DuckDB and NSQ. - **First-party GitHub identities:** Release and maintained integration links consistently use the [HitKeep organization](https://github.com/HitKeep), including the [application source and releases](https://github.com/HitKeep/hitkeep). The [OAuth guide](https://hitkeep.com/guides/security/oauth/) covers client registration, discovery, resource binding, refresh rotation, and revocation. Use the [WordPress guide](https://hitkeep.com/guides/integrations/wordpress/) for plugin setup, the [MCP guide](https://hitkeep.com/guides/integrations/mcp/) for assistant connections, and [API clients](https://hitkeep.com/guides/security/api-clients/) for manual tokens. Managed option ## Run HitKeep without the ops burden. HitKeep Cloud runs the same single binary in region-pinned EU or US infrastructure, with managed updates and backups. [Start free in HitKeep Cloud](https://cloud.hitkeep.eu/signup?utm_source=hitkeep_docs&utm_medium=website&utm_campaign=cloud_signup&utm_content=content_cta&plan=free&billing=monthly)[Self-host instead](https://hitkeep.com/guides/installation/) [← OlderHitKeep 2.14.0: Chart Annotations, Ask AI Chat, and Themes](https://hitkeep.com/blog/hitkeep-2-14-0/)