2.1 Orbit MCP Setup

1. Overview

Orbit exposes two access channels, both of which require authentication:

• MCP (Model Context Protocol) Server — for AI agents and LLM clients such as Claude, ChatGPT, and Cursor.

To support both machine-to-machine integrations and end-user delegated access, Orbit supports two authentication methods:

Method	Channels	Typical Use Cases
OAuth 2.0 / 2.1	REST API, MCP (remote HTTP)	Third-party app integrations, end-user delegated access, AI agent remote tool calls

2. Base URLs & Interactive References

Before issuing any request, make sure you are calling the correct endpoint. Orbit exposes two independent services, each with its own base URL and interactive documentation:

Service	Base URL	Interactive Reference	Description
MCP Server	https://mcp.orbitfin.ai/server/mcp	https://mcp.orbitfin.ai/docs 2	Streamable HTTP MCP endpoint for LLM clients (Claude Code, ChatGPT, Cursor, …) following the Model Context Protocol specification.

Quick Reference

MCP Server

<HTTP>
Endpoint:         https://mcp.orbitfin.ai/server/mcp
Transport:        Streamable HTTP (MCP spec)
Docs:             https://mcp.orbitfin.ai/docs
Auth (API Key):   X-API-KEY: <your-api-key>
Auth (OAuth):     Authorization: Bearer <access_token>   ← see §3

Minimal Smoke Tests

Verify your key works against each surface in under 10 seconds.

MCP Server — connect via JSON config

{
  "mcpServers": {
    "orbit": {
      "url": "https://mcp.orbitfin.ai/server/mcp",
      "headers": {
        "X-API-KEY": "<your-api-key>"
      }
    }
  }
}

For the full list of MCP tools, resources, and prompt templates exposed by the server, browse the interactive catalog at https://mcp.orbitfin.ai/docs ².

Unified Billing Across Both Surfaces

API Key usage on either surface draws from the same credit pool on your Orbit account:

Universal Currency: Same credits work for both APIs and MCP · APIs: Direct programmatic access charges credits per operation · MCP: Natural language queries consume credits based on complexity · Shared Pool: API and MCP usage draws from the same credit balance

. There is no need to provision separate quotas — a single API key (or a single OAuth-authenticated user, see §3) is billed uniformly.

3. Method 1: API Key Authentication

1. Sign in to the Orbit Console[https://insight.orbitfin.ai/] → Settings → API Keys.

1. Click Create API Key, give it a name, and save.

3.2 Using API Key with MCP

For local stdio MCP clients or trusted environments:

<JSON>

{
  "mcpServers": {
    "orbit": {
      "url": "https://mcp.orbitfin.ai/server/mcp",
      "headers": {
        "X-API-KEY": "<your-api-key>"
      }
    }
  }
}

3.3 Security Best Practices

API keys are long-lived credentials that do not carry user identity, which makes per-user authorization difficult and creates significant risk if leaked into logs or version control; audit trails can only record what an API key did, not which user.

Therefore:

• Never embed API keys in frontend code.

• Never commit them to Git.

• Rotate keys regularly.

• Follow the principle of least privilege when assigning scopes (where supported).

4. Method 2: OAuth 2.0 Authentication (Recommended for MCP & Third-Party Apps)

4.1 When to Use OAuth 2.0

• Third-party SaaS applications integrating with Orbit.

• AI agents / LLM clients calling Orbit tools via remote MCP.

• Any scenario that requires end-user identity rather than application identity, with a complete audit trail.

4.2 Calling the MCP with an Access Token

<JSON>

{
  "mcpServers": {
    "orbit": {
      "url": "https://mcp.orbitfin.ai/server/mcp",
      "headers": {
        "Authorization": "Bearer <access_token>"
      }
    }
  }
}

4.3 OAuth Configuration for the Remote MCP Server

When integrating with MCP-aware clients (Claude Desktop, ChatGPT, etc.), Orbit's MCP Server exposes the standard discovery endpoints:

• https://mcp.orbitfin.ai/.well-known/oauth-protected-resource — Resource metadata

On first connect, the client automatically discovers these endpoints and initiates the OAuth flow.

After the OAuth flow completes, the client attaches the obtained access token via the Authorization: Bearer … header on subsequent MCP requests. The server must treat the token as untrusted and perform full resource-server validation: signature verification, issuer/audience checks, expiration, replay protection, and scope enforcement.

4.4 Connecting Orbit MCP in Claude Code & ChatGPT

Thanks to OAuth 2.0 + DCR, end users do not need to manually create an API key or paste any token. The entire setup is just three steps:

▶ Claude Code

1. Open Claude Code → Settings → Connectors → Add Custom Connector.

2. Fill in the form:

   • Name: any name you like, e.g. Orbit

   • Remote MCP server URL: https://mcp.orbitfin.ai/server/mcp

3. Click Add. Claude Code will automatically:

   • Discover Orbit's .well-known OAuth metadata,

   • Register itself via Dynamic Client Registration,

   • Open a browser window to the Orbit Insight login page.

4. Enter your Insight platform username and password to authorize.

5. Done ✅ — the Orbit tools are now available inside Claude Code.

Example configuration (as shown in the screenshot):

<TEXT>Name:                OrbitRemote MCP server URL: 
https://mcp.orbitfin.ai/.well-known/oauth-protected-resource

▶ ChatGPT

1. Open ChatGPT → Settings → Connectors → Create(or Add custom connector in the Developer Mode panel).

2. Fill in:

   • Name: Orbit (or any name you prefer)

   • MCP Server URL: https://mcp.orbitfin.ai/server/mcp

   • Authentication: select OAuth

3. Click Create / Connect. ChatGPT will redirect you to the Orbit Insight login page.

4. Sign in with your Insight platform username and password to grant access.

5. Done ✅ — Orbit tools appear in ChatGPT's tool list and can be invoked in conversations.

Why it's this simple

• Orbit's MCP server publishes OAuth discovery metadata at https://mcp.orbitfin.ai/.well-known/oauth-protected-resource

• Clients (Claude Code / ChatGPT) auto-register via Dynamic Client Registration, so no client_id / client_secret setup is required by the user.

• The user only authenticates once with their existing Insight account; refresh tokens keep the session alive.