Permissions and approvals
Sqquid uses OAuth permissions. You review these permissions when you connect an AI application.
Each authorization belongs to:
- one Sqquid user.
- one Organization.
- one Account.
- one AI client.
The AI client can only use the permissions that you approve.
Permission scopes
Section titled “Permission scopes”| Permission | What it allows |
|---|---|
account:read |
Read the user, Organization, Account, plan, limits, and setup status. |
account:write |
Select a plan and start a subscription checkout. |
products:read |
Read products and product synchronization errors. |
products:write |
Queue a product export. |
connections:read |
Read Connections, settings, readiness, and available integrations. |
connections:write |
Add, configure, enable, disable, and synchronize Connections. |
locations:read |
Read locations. |
locations:write |
Create, update, and delete locations. |
routing:read |
Read routing rules and simulate routing. |
routing:write |
Replace the order routing configuration. |
A write permission also includes the matching read permission.
If a tool reports insufficient_scope, authorize Sqquid again with the required permission.
Changes that require approval
Section titled “Changes that require approval”These tools show the proposed change before they apply it:
connections_update_settings.connections_apply_preset.connections_enable.connections_disable.connections_map_locations.locations_delete.routing_save.
The assistant must show the approval request. The tool does not apply the change until you approve it.
Approval applies only to the displayed tool input. If the input changes, Sqquid requests a new approval.
Actions that use a browser
Section titled “Actions that use a browser”connections_connect opens the provider authorization page. account_setup can open Stripe Checkout.
Complete the browser action yourself. Sqquid does not ask the assistant to enter your provider password or payment information.
After you complete the action, return to the AI application. The assistant must call the same tool again with the same arguments.
Immediate and queued changes
Section titled “Immediate and queued changes”Some write tools do not show an additional approval request.
| Type | Tools |
|---|---|
| Immediate | connections_create, locations_create, locations_update |
| Queued | connections_import_inventory, connections_import_products, products_export |
Review the assistant’s proposed values before you ask it to call an immediate tool.
A queued result only confirms that Sqquid accepted the work. Check the result with the tool named in the response.
Credentials and private data
Section titled “Credentials and private data”connections_create sends provider credentials from the AI client to Sqquid. Use this tool only in an AI application that you trust. Review the AI application’s data policy before you send credentials.
The Sqquid MCP server does not return stored Connection credentials or access tokens. Sqquid tool telemetry records call metadata. It does not record tool inputs or outputs.
Never paste an MCP access token into a conversation or support message.
End access
Section titled “End access”Use your AI application’s revocation control when you no longer need Sqquid MCP. Removing the connector from the client may only remove its local configuration; it does not by itself confirm that the authorization was revoked.