Dapper, everywhere

The Dapper MCP server exposes the whole API as discoverable tools for any MCP-compatible agent. Connect a client and sign in with your Dapper account in the browser — no API key to paste.

Step-by-step setup

Walkthroughs for the clients we get asked about most, each with what it needs before you start: what kind of account, whether the plan has to be a paid one, and whether it works in the browser or only from a terminal.

Other clients & agents

Copy-paste config for the rest of the MCP clients. Claude, ChatGPT and Gemini CLI have their walkthrough above. The endpoint is the same everywhere; you sign in in the browser.

{
  "mcpServers": {
    "dapper": {
      "url": "https://api.dapperglobal.com/mcp"
    }
  }
}

https://api.dapperglobal.com/mcp

{
  "mcpServers": {
    "dapper": {
      "url": "https://api.dapperglobal.com/mcp"
    }
  }
}

https://api.dapperglobal.com/mcp

{
  "servers": {
    "dapper": {
      "type": "http",
      "url": "https://api.dapperglobal.com/mcp"
    }
  }
}

https://api.dapperglobal.com/mcp

https://api.dapperglobal.com/mcp

Connect with an API key (no browser)

For clients that connect from a server, a script or an agent platform and can't open a browser. The same API key from the dashboard works three ways: use whichever your platform's form offers. All three identify the same key: usage is recorded under it and revoking it cuts access on all three.

1. X-API-Key header

For clients whose MCP config accepts custom headers (Cursor, scripts, CI). It is the same header the REST API uses.

{
  "mcpServers": {
    "dapper": {
      "url": "https://api.dapperglobal.com/mcp",
      "headers": { "X-API-Key": "dpr_live_..." }
    }
  }
}

2. Bearer token

For platforms with a single “Bearer token”, “API key” or “Authorization” field. Paste the full key; if the field wants the whole header, it is this:

Authorization: Bearer dpr_live_...

3. OAuth client credentials

For platforms that ask for a Client ID, a Client Secret and a Token URL. The platform exchanges the key for a one-hour access token and renews it on its own.

Token URL

https://api.dapperglobal.com/oauth/tokenCopy

Where the platform exchanges your credentials for the access token. Not /mcp/token, which belongs to the browser login.

Client ID

your API key's ID

A UUID. It is shown in the dashboard under each key's prefix, with a copy button.

Client Secret

dpr_live_...

The full API key, the one shown only once when it is created or rotated.

Grant type

client_credentials

If the platform asks. This grant has no refresh token: when it expires, a new one is requested with the same credentials.

Credential transport

Basic or body

Both are accepted: an Authorization: Basic header (client_secret_basic) or form fields (client_secret_post). If there is a “Basic Auth in header” checkbox, either state works.

Scope

mcp:read

Optional; mcp:read is always granted. Leave it empty unless the platform requires one.

If the platform only says “couldn't connect”, this request shows what the server answers. A 401 invalid_client means the ID and key don't match, or the key is revoked or expired.

curl -s https://api.dapperglobal.com/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=<key-id> \
  -d client_secret=dpr_live_...

# -> {"access_token": "dpr_at_...", "token_type": "Bearer",
#     "expires_in": 3600, "scope": "mcp:read"}

Applies to all three

• Use a key with no country or domain restriction. A restricted key keeps working over REST, but the MCP server rejects it (401, or unauthorized_client on the exchange) because it can't enforce that restriction yet.
• MCP calls show up in the dashboard's MCP tab. Revoking the key cuts access immediately — no need to wait for any token to expire.
• Rotating a key creates a new key with a different ID. Update the key on the platform before the old one expires and, if you use client credentials, the Client ID too.

What you can ask

Examples a connected agent can answer against Dapper's data.