Connect Cursor to your ad accounts

The credential comes before the configuration, because the configuration is mostly the credential. Keys live in the product under Settings and then MCP. A key is bound to exactly one workspace for its whole life, it is shown once, only its prefix and a hash of it are stored, and it is revocable on its own without touching any other key.

Three decisions are made at the mint and all three are visible from the editor afterwards.

The name is what you will read a month from now when you are deciding which key to revoke, so name it after the thing holding it rather than after the day you made it.

The scopes decide what the client can do. Every key carries read. Draft and approve are independent additions rather than rungs on a ladder, and the check a tool makes is an exact match on the one scope it needs. Mint the first one with read only.

The surface decides how many tools appear. The default registers two tools that dispatch onto every capability, which is the right answer for a client working inside a context budget. The alternative registers each capability as its own tool. Both reach the same capabilities under the same scopes and give the same answers, so the choice is only what the tool list costs you in context.

If you want the longer argument about which scopes a key should carry, How to scope an MCP key is that argument.

One block of configuration, in Cursor's mcp.json. Replace the key with the one you just minted.

{
  "mcpServers": {
    "tempio": {
      "url": "https://app.tempio.ai/api/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

That is the whole of it. The transport is streamable HTTP at a single endpoint and there is no server-sent-events transport to select — a client configured to negotiate one will fail rather than fall back, which is worth knowing because the failure reads like a bad key.

Two decisions about where the file lives. A project-level file travels with the repository, which means the key travels with the repository, which means the key is in your version control history the moment somebody commits it. Use the user-level location for anything you would not paste into a pull request. If a project file is genuinely the right place, the key belongs in an environment variable your shell supplies rather than in the literal text.

The same shape works for any client that can send an Authorization header over streamable HTTP, which is most of them; Connect any MCP client to your ad accounts is the general form, including the clients that cannot send a header at all.

Ask the editor to list its tools. What you should see depends on the surface and the scopes, and the two failure modes look different.

No tools at all means the connection did not authenticate: a wrong header, a revoked key, or a client expecting a transport this server does not serve. Fewer tools than you expected means the key is narrower than you thought, or it was minted on the compact surface, where two tools reach everything.

Then ask the first real question, in the editor's chat rather than in a file:

Which ad platforms are connected, and when did each last sync?

Each row that comes back carries more than a status. There is a capabilities object on every connection saying what that platform can actually express: which change operations it supports, where budget attaches, which objectives it accepts, what a deletion means there, and whether a change can be dry-run against the platform before it is applied. That last pair matters, because on some platforms a removal is irreversible and the entity is simply gone.

The reason to have this in an editor at all is that the questions you ask while writing something are different from the questions you ask while sitting in a dashboard.

Blended spend and results for the last thirty days, with the per-channel breakdown.

Money comes back as an integer in minor units with its currency beside it, never a formatted string, and a blend across two currencies is a labelled estimate carrying the date of the oldest rate it leaned on rather than a silent sum. Ratios are computed when they are read and come back empty when the denominator is zero. Read an empty ratio as "there is nothing to divide by" and never as a zero — that substitution is the most common way a report lies to the person holding it.

List the campaigns under that account, including the ones that are not delivering.

Structure reads down through ad groups, ads, creatives and keywords, each row carrying its own absolute link into the app. The link is for a person to open; it is not a grant, and the page behind it still checks membership.

First prompts for your ad accounts is the longer list of questions worth asking on day one.

With a draft-scoped key, a request for a change produces a change request rather than a change. The drafting call takes a connection and a list of operations and writes them as one reviewable batch, up to fifty entries, refused rather than truncated if the list is longer. Where entries depend on each other, each child names the index of the entry that creates its parent, so nothing carries an identifier that does not exist yet.

What comes back is the batch, a link to the gate for the whole group, and the authority that cleared it — pending when it is waiting for a person, and the rule's name when a rule the workspace wrote cleared every row on the way in.

The shape is worth stating once in plain words, because the editor is exactly where somebody forgets it. Your connections read your accounts. A change the agent asks for is written as a draft on the record, with the state it would change from and the checks it passed. Applying it is gated on approval — by you, or by a rule you wrote — and no platform write reaches a customer account until that platform has granted write access. Applying a cleared change to a platform is in private beta.

Three habits, none of them onerous.

One key per client. A shared key cannot be revoked without taking down everything else holding it, and the last-used stamp stops meaning anything the moment two things use it.

Treat it as a production secret. It is a workspace credential and not a personal one: an environment variable or a secret store, never a commit, never a screenshot.

Know that it dies with its creator's membership. Membership is re-read on every call rather than checked once at the mint, so a key minted by somebody who later leaves the workspace stops answering in the same moment, with nothing to revoke by hand. For anything that has to outlive one person, mint it under an account that is not going anywhere and say so in the key's name.

If there are no tools, check the header and then the key's status on the settings page. A revoked key and a typo are indistinguishable from the client.

If a reading tool answers with nothing, check that the connection has finished a sync. An account that has never synced is empty rather than broken, and the two look identical from the editor.

If requests start failing in a loop, you have met the rate limit: a hundred and twenty a minute per address before authentication, sixty a minute per credential after it. An agent iterating over campaigns one at a time will find that ceiling; asking for the rows in one call will not.

The reasoning behind the gate all of this eventually meets is in Why every change is a draft.