About

Any programme that talks to Elium on behalf of a user, whether a script of yours, an integration platform or an AI assistant, authenticates with OAuth 2.0. You register it once as a connected application, it receives a client ID and a client secret, and each user approves it before it acts in their name. Every call then runs with the permissions of that user: an application never sees more than the person who connected it.

Elium exposes two things to connected applications:

The API, a GraphQL API at https://your-platform-name.elium.com/graphql, to read and write content, users, spaces and more. The API documentation covers the main concepts, a quick start and how-to guides, with the full GraphQL reference.
The MCP server, at https://your-platform-name.elium.com/services/mcp, for AI assistants: see MCP.

Register an application

Open the administration panel: click your avatar, choose "Settings", then "Advanced" and "Security".
In the "Connected apps" block, click "New application".
Give it a Title: it is shown to users on the consent screen.
Add one or more Redirect URLs: the addresses your application is allowed to send users back to after they approve it. Click "Add a redirect URL" for each environment (production, staging, local development).
Tick the Scopes the application needs (see below).
Turn on Trusted if users should not have to approve the application themselves. Keep it off for anything you do not control.
Click "Save".

The application appears in the table with its Client ID and Client Secret. Click the secret to reveal or copy it. Store both in your application's configuration: the secret is never sent by email.

Scopes

A scope is a permission the application asks for. Users see them on the consent screen.

Scope	What the user approves
API	Access the API on their behalf: everything the user can do in Elium, through GraphQL.
MCP	Search and read the knowledge base on their behalf, through the MCP server.
MCP (writable)	Create articles in the knowledge base on their behalf, through the MCP server. Requires MCP.

Grant the smallest set that does the job. An AI assistant that only answers questions needs MCP alone; a synchronisation script needs API.

You can change the scopes of an existing application at any time with "Edit". The change applies to tokens issued from then on; users who already connected keep their current permissions until their token is renewed.

Connect your application

Click "OAuth details..." on an application to get everything a developer needs, with an API tab and an MCP tab:

Endpoint: the API or MCP address of your platform.
Authorisation URL: https://your-platform-name.elium.com/oauth/authorize
Access token URL: https://your-platform-name.elium.com/oauth/token
Client ID, client secret, redirect URLs and scopes.

The flow is the standard authorization code grant, with PKCE supported. The user is sent to the authorisation URL, signs in to Elium if needed, reviews the requested scopes and approves. Your application exchanges the code for an access token and a refresh token at the token URL, authenticating with its client ID and secret. Tokens can be revoked at /oauth/revoke. The server also publishes its metadata at the standard .well-known address, so OAuth libraries can configure themselves from the platform address alone.

Call the API with the access token in an Authorization: Bearer header. The API documentation explains the objects and their relations and walks through common actions. To try queries against your own data, open https://your-platform-name.elium.com/graphiql while signed in: it lists every query and mutation available on your platform.

Dynamic client registration

Some AI clients register themselves instead of asking you for a client ID and secret. Elium supports dynamic client registration (DCR) for an allow-list of known clients, among them Claude, ChatGPT, Visual Studio Code, Intercom and Microsoft Copilot. Their redirect addresses are checked against the allow-list, and they can only request the MCP scopes.

An application registered this way appears in the table with a "DCR" badge. Its title and redirect URLs are managed by the client and cannot be edited, but you can adjust its scopes or delete it like any other.

To allow another client, or to add redirect addresses for one of yours, contact support@elium.com with the client name and its redirect URLs.

Remove an application

Click "Delete" on an application to remove it. Its client ID and secret stop working at once, and every token issued to it is invalid: users who connected it lose access until they connect a replacement.