> ## Documentation Index > Fetch the complete documentation index at: https://developers.perform.ai/llms.txt > Use this file to discover all available pages before exploring further. # Security & Compliance > How Perform.AI authenticates portal users, API clients and MCP sessions, and which roles control access to your account. **Available to all Platform customers.** Users with the Administrator role manage users and roles. ## Summary Security & Compliance covers how people and systems get into your Perform.AI account: portal login with a password or your company’s single sign-on, role-based access for your users, OAuth 2.0 client credentials for the Public API, HMAC-signed outgoing webhooks, and OAuth 2.1 sign-in for the MCP server. Each surface authenticates separately, and every one of them acts only on the account or organization it was issued for. ## Who it’s for IT, security and compliance teams completing a supplier review, administrators deciding who gets which role, and developers who need to know how credentials and tokens work before they integrate. ## Key benefits * **Login follows your identity provider.** Organizations can federate portal login to their own identity provider, which then enforces its own credential rules, including any multi-factor policy, and can switch password login off entirely. * **Passwords have rules and a lockout.** Passwords must meet complexity rules, five failed attempts lock the account until a reset is completed, and the reset form is protected against bots. * **Roles limit what each user sees and does.** Five roles cover administration, shipment creation, analytics, tracking experiences and customer service, and only Administrators manage users. * **API access is credential-based and short-lived.** Each account has a Client ID and Client Secret; tokens last one hour and can be rotated without downtime. * **Your assistant sees exactly what you see.** MCP sessions run as the signed-in user, scoped server-side to one organization and that user’s portal permissions, and every tool is read-only. ## How it works ### Portal login The login page offers two paths, a **Password** tab and an **SSO** tab, and which tabs are available is an organization-level setting. | Path | How it works | | - | - | | Password | You enter your email and password. Perform.AI enforces the complexity rules and the lockout below. | | SSO | You are redirected to your organization’s identity provider and log in there; Perform.AI never sees your password. Your identity provider enforces its own credential rules, including any multi-factor policy. Supported federations: Google, Microsoft Entra ID (Azure AD) and SAML-based providers. | Password rules: at least 10 characters, with an uppercase letter, a lowercase letter, a digit and a special character, and no spaces. Five consecutive failed attempts lock the account, and the lock stays even if the correct password is entered afterwards, until a password reset is completed. The reset form is protected by reCAPTCHA. Perform.AI does not force periodic password changes. Organizations with SSO can go **SSO-only**: password login is switched off, new users receive no password-creation email, and a user who signs in through SAML for the first time is created and assigned a role automatically. An SSO-only user cannot use the Password tab, because no password exists. After either path, a signed session is issued that persists across browser restarts. ### Roles Only Administrators can open **User Management** and add, edit or remove users. Each user holds one of five roles. | Role | Access | | - | - | | Administrator | Full access to every feature, including User Management and report export. | | Parcel Creation | Shipment Overview and Parcel Details; upload and edit shipments; export the Shipment Overview report. | | Logistics Intelligence | View and extract analytics charts. Tags can limit which shipments the user sees. | | Tracking Experience | Manage Tracking Pages and widgets. | | Customer Service | View and edit all parcel details and work with email notifications and webhooks, or view-only access to all or a limited set of shipments, limited by carrier reference or tag. | User statuses are Inactive (never logged in), Active (has logged in) and Disabled (disabled when the subscription expired or was downgraded). Steps are on the [User Management](https://developers.perform.ai/products/user-management.md) page. ### Public API authentication The Public API accepts HTTPS only and uses OAuth 2.0 Bearer tokens. | Item | Rule | | - | - | | Credentials | A Client ID and Client Secret per account, created under **Integrations** > **API** with **Request Credentials**. Anyone who holds them can call the API for that account: keep the secret on a server, never in client-side code, apps or repositories. | | Token | `POST /auth/oauth/token/` with HTTP Basic (`client_id:client_secret`, Base64) and a form-encoded `grant_type=client_credentials` body returns `access_token`, `expires_in: 3600` and `token_type: Bearer`. | | Lifetime | One hour. There is no refresh token; request a new token before the hour is up. Requesting a new token does not invalidate existing ones, so tokens can be rotated without downtime. | | Scope | Every call acts on the account the credentials belong to. Calling a capability the account has not enabled returns a validation error. | | Failure | A wrong secret or an expired token returns HTTP 403 with `Key not authorized`. | ### Outgoing webhook authentication Every webhook Perform.AI sends carries an `HTTP-X-Hmac-SHA256` header: the HMAC-SHA256 of the raw request body, keyed with the Authentication Key shown under **Integrations** > **Webhooks**. Recompute it on your side and compare; a match proves the webhook came from Perform.AI. HMAC is the default. OAuth 2.0, JWT, Basic or a static key can be arranged through your account team. Allowlist Perform.AI by hostname rather than IP. ### MCP sign-in The Perform.AI MCP server at `https://mcp.perform.ai/mcp` uses OAuth 2.1 with discovery and dynamic client registration. No API keys are involved: your client opens the Perform.AI sign-in page on first use, and you sign in with your Perform.AI username and password or with **Sign in with Google**. * **Who can connect.** Anyone with a Perform.AI account in at least one organization. Each person signs in with their own account; teams share nothing but the server URL. * **Organization scoping.** After sign-in you select which of your organizations the session acts on, and can switch at any time. No tool accepts an organization parameter; the organization is resolved server-side from the validated session. Identifiers from other organizations return not-found, and responses never confirm that another organization’s data exists. * **Data visibility.** Exactly what you can see in the portal, nothing more. A user removed from an organization loses access through the MCP as well. Shipment details can include recipient names, addresses, emails and phone numbers when your portal permissions allow them; the default concise view omits most of these fields, and more detailed views return them. * **Read-only.** No tool creates, updates or deletes anything. Changes are made in the portal. * **Redirect URIs.** Third-party clients must register HTTPS redirect URIs; loopback URIs for desktop clients are always accepted. A client that redirects to a domain Perform.AI does not recognise shows a consent screen naming the destination. To allowlist your redirect domains, contact your account team. * **Data handling.** Data goes only to the client you connected, over your authenticated session. How that provider handles it is governed by your agreement with that provider. ### Certifications and data protection ## Set up in the portal ### Manage users and roles 1. Go to **Settings** > **Users**. 2. Select **Add user**, enter the email address and select **Continue**. 3. Choose a role and select **Add**. To change a role or remove a user, select the user’s email address in the list. ### Request API credentials 1. Go to **Integrations** > **API** and select **Request Credentials**. 2. Store the Client ID and Client Secret on your server. 3. Generate a token with `POST /auth/oauth/token/` and send it as `Authorization: Bearer` on every call. ### Secure your webhook endpoint 1. Go to **Integrations** > **Webhooks** and register your HTTPS endpoint. 2. Copy the Authentication Key and use it to verify the `HTTP-X-Hmac-SHA256` header on every request. ### Configure SSO Contact your account team. ## Use via API and MCP * Guide: [Authentication](https://developers.perform.ai/authentication.md). * API reference: [Generate Bearer Access Token](https://developers.perform.ai/api-reference/v5/authentication/generate-bearer-access-token.md). * MCP: [Installation](https://developers.perform.ai/mcp/installation.md) covers the sign-in flow per client; the [MCP overview](https://developers.perform.ai/mcp/overview.md) covers scoping and permissions. ## FAQ ### Does Perform.AI support single sign-on? Yes. Login is configured per organization: password, SSO through Google, Microsoft Entra ID or a SAML-based provider, or both. An organization can also be SSO-only, with password login switched off. ### How do we meet a multi-factor authentication requirement? Federate portal login to your own identity provider through SSO. Your identity provider then enforces its own credential rules, including its multi-factor policy, on every login. ### I entered the correct password and I am still locked out. Why? After five failed attempts the account stays locked until a password reset is completed, even if the correct password is entered afterwards. Complete the reset. ### How long does an API token last, and what happens when it expires? One hour. Expired tokens return HTTP 403 `Key not authorized`. Request a new token before the hour is up; existing tokens stay valid, so you can rotate without downtime. ### Can my AI assistant change my shipments or configuration through the MCP? No. Every MCP tool is read-only. The assistant can analyse a setup and suggest changes; you apply them in the portal. ### Does the MCP see more than I see in the portal? No. Every call runs as the signed-in user, scoped to the selected organization, with the same visibility as your portal login. ## Troubleshooting | Symptom | Cause | Fix | | - | - | - | | Account locked after failed logins | Five consecutive failed password attempts | Complete the password reset; the lock stays until the reset is done. | | An SSO user cannot log in on the Password tab | SSO-provisioned users have no password | Use the SSO tab. If the identity provider is unavailable, your administrator must arrange access. | | API returns HTTP 403 `Key not authorized` | Wrong Client Secret or expired token | Check the credentials and request a new token. | | Raw HTTP call to the MCP URL returns `401 invalid_token` | No completed OAuth flow | Expected. Connect through an MCP client that runs the sign-in flow. | | MCP client is connected but returns no data | No organization selected, or the subscription has lapsed | Select an organization in the conversation; if the subscription has lapsed, contact your account team. | ## Related * [User Management](https://developers.perform.ai/products/user-management.md) * [Data Integration](https://developers.perform.ai/products/platform/data-integration.md) * [Platform overview](https://developers.perform.ai/products/platform/overview.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.