About

Any programme that talks to Elium on behalf of a user, whether a script of yours, an integration platform or an AI assistant, authenticates with OAuth 2.0. You register it once as a connected application, it receives a client ID and a client secret, and each user approves it before it acts in their name. Every call then runs with the permissions of that user: an application never sees more than the person who connected it.

Elium exposes two things to connected applications:

The API, a GraphQL API at https://your-platform-name.elium.com/graphql, to read and write content, users, spaces and more. The API documentation covers the main concepts, a quick start and how-to guides, with the full GraphQL reference.
The MCP server, at https://your-platform-name.elium.com/services/mcp, for AI assistants: see MCP.

Register an application

Open the administration panel: click your avatar, choose "Settings", then "Advanced" and "Security".
In the "Connected apps" block, click "New application".
Give it a Title: it is shown to users on the consent screen.
Enter the first address in Redirect URLs. These are the addresses your application can send users back to after approval. Click Add a redirect URL for each additional address, for example for a test environment. Enter one address per field.
Tick the Scopes the application needs (see below).
Turn on Trusted if users should not have to approve the application themselves. Keep it off for anything you do not control.
Click "Save".

The application appears in the table with its Client ID and Client Secret. Click the secret to reveal or copy it. Store both in your application's configuration: the secret is never sent by email.

Manage redirect URLs

For an application you registered manually:

In Connected apps, open the application's menu and choose Edit.
Under Redirect URLs, edit an existing address, click Add a redirect URL to add a field, or click the bin icon beside an address to remove it.
Click Save.

The table shows the first address and a +1, +2 or similar button for the remaining addresses. Click it to view all addresses and copy them individually. Click outside the list to close it. Opening another application's list closes the previous one.

Scopes

A scope is a permission the application asks for. Users see them on the consent screen.

Scope	What the user approves
API	Access the API on their behalf: everything the user can do in Elium, through GraphQL.
MCP	Search and read the knowledge base on their behalf, through the MCP server.
MCP (writable)	Create articles and save edits as drafts on their behalf, through the MCP server. Requires MCP, writing enabled on the platform and the user’s article permissions.

Grant the smallest set that does the job. An AI assistant that only answers questions needs MCP alone; a script that calls GraphQL needs API. For targeted article edits through MCP, see MCP.

You can change the scopes of an existing application at any time with "Edit". The change applies to tokens issued from then on; users who already connected keep their current permissions until their token is renewed.

Connect your application

Click "OAuth details..." on an application to get everything a developer needs, with an API tab and an MCP tab:

Endpoint: the API or MCP address of your platform.
Authorisation URL: https://your-platform-name.elium.com/oauth/authorize
Access token URL: https://your-platform-name.elium.com/oauth/token
Client ID, client secret, redirect URLs and scopes.

The flow is the standard authorization code grant, with PKCE supported. The user is sent to the authorisation URL, signs in to Elium if needed, reviews the requested scopes and approves. Your application exchanges the code for an access token and a refresh token at the token URL, authenticating with its client ID and secret. Tokens can be revoked at /oauth/revoke. The server also publishes its metadata at the standard .well-known address, so OAuth libraries can configure themselves from the platform address alone.

Call the API with the access token in an Authorization: Bearer header. The API documentation explains the objects and their relations and walks through common actions. To try queries against your own data, open https://your-platform-name.elium.com/graphiql while signed in: it lists every query and mutation available on your platform.

Dynamic client registration

Some AI clients register themselves instead of asking you for a client ID and secret. Elium supports dynamic client registration (DCR) for an allow-list of known clients, among them Claude, ChatGPT, Visual Studio Code, Intercom and Microsoft Copilot. Their redirect addresses are checked against the allow-list, and they can only request the MCP scopes.

An application registered this way appears in the table with a "DCR" badge. Its title and redirect URLs are managed by the client and cannot be edited, but you can adjust its scopes or delete it like any other.

To allow another client to register dynamically, or to add redirect addresses to the allow-list for an existing client, contact support@elium.com with the client name and its redirect URLs.

Remove an application

Click "Delete" on an application to remove it. Its client ID and secret stop working at once, and every token issued to it is invalid: users who connected it lose access until they connect a replacement.

API and connected applications