Set up StratNav keys for API and MCP access

StratNav uses OAuth 2.0 to authenticate access to its REST API and MCP server. Your integration exchanges its client ID and client secret for a short-lived access token, then sends that token with each request. StratNav signs the token with a private key, and the API verifies the signature with the matching public key. A project key limits access to one project, while an account key follows the projects your account can access and the permissions you chose when creating the key.

Choose the right key for your integration

Your reporting dashboard needs figures from one strategy project. Your AI assistant might need to compare initiatives across several. Which projects should each integration be able to see, and what should it be able to change?

StratNav offers two kinds of API keys. A project-specific key connects an integration to one project. An account-specific key follows the projects your account can access and lets you choose whether the integration can read, add, update, or delete records.

For example, if you run strategy reviews for several clients, a dashboard built for one client can use that client’s project key. An internal reporting tool that needs to pull information from all the projects you work on can use a read-only account key. That account key will also cover projects you gain access to later, so consider which systems should have that reach.

Account API key management requires the Pro plan. If you’re on Free or Starter, StratNav redirects you to Pricing when you open the account keys page. Compare StratNav plans

Create an API key for one project

1. Sign in to StratNav and open the project you want to connect.
2. Open the project menu and select API Keys. If you can’t see the menu item, check that you have edit access to the project.
3. Select Create API Keys. If the project already has a key, the page shows its existing credentials.
4. Copy the Client ID and Client Secret into the integration’s secure credential store. Make sure you’re configuring the integration for the project you opened.

A project key is useful when the project itself defines the boundary. For instance, you can connect a single strategy plan to a reporting workflow without giving that workflow access to other plans under your account. The REST API still determines which operations are available for that project.

To remove the connection, return to the project’s API Keys page and select Revoke API Keys. If you create a replacement, update every integration that used the previous project key.

Create an API key for your account

1. Open Account Settings and select Manage Account API keys beside Delete Account. You can also open the account keys page directly after signing in. Manage account API keys
2. In Create Account API Keys, enter a name that identifies the integration. For example, use Monthly portfolio reporting so you can recognise the key later.
3. Choose an Access level.
4. Select Create account key.
5. Copy the Client ID and Client Secret when they appear. This is the only time you will see the account key’s client secret. Save it securely before leaving or refreshing the page.

Your new key appears in Manage Active Account API Keys, along with its access level. If you lose the secret, create a replacement, update the integration, and revoke the old key. Naming each key after the integration it serves makes it easier to identify the right one.

Understand account key permissions

• Read only lets the integration list projects and read their contents. This is the default.
• Read, add, and update also lets it create and edit records where your project role permits those actions. This includes adding notes.
• Read, add, update, and delete also lets it delete records where your project role permits deletion.

For a write to succeed, both the key and your current project role must permit it. For example, if you’re a Commenter, a write-enabled account key can add a note in that project. If you have read-only access to another project, the same key can only read it there.

StratNav checks project membership when the integration makes a request. If you join a new project, it becomes available through the same account key. If your access to a project is removed, the key loses that access too. To stop an integration from using an account key across all projects, revoke the key in Manage Active Account API Keys.

Exchange your credentials for an access token

Both kinds of key use the same OAuth client credentials flow. If your integration asks for a token URL, use https://www.stratnavapp.com/oauth/token and select Client Credentials as the grant type. Supply the client ID and secret from the key you created.

If you’re testing from a shell, load the credentials into STRATNAV_CLIENT_ID and STRATNAV_CLIENT_SECRET using your preferred secure method. Then make the token request:

curl --request POST 'https://www.stratnavapp.com/oauth/token' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode "client_id=$STRATNAV_CLIENT_ID" \
  --data-urlencode "client_secret=$STRATNAV_CLIENT_SECRET"

A successful response includes access_token, token_type, and expires_in. Use the returned access token as a bearer token for API calls. Use expires_in to determine when the integration needs to request a new token. Keep the token and client secret out of application logs and screenshots.

Test which projects your key can access

Start with GET /v1/Projects. It verifies that the token works and shows the project IDs you can use for subsequent calls. Set STRATNAV_ACCESS_TOKEN to the token returned by the previous request, then run:

curl 'https://api.stratnavapp.com/v1/Projects' \
  --header "Authorization: Bearer $STRATNAV_ACCESS_TOKEN"

With a project key, expect the project you created the key for. With an account key, expect the projects your account can currently access. Check that the list matches what you intended before you schedule an automation or give an assistant write access.

If you’re using an MCP client that supports a supplied bearer token, connect it to https://api.stratnavapp.com/mcp using Streamable HTTP and the access token. Start with list_projects. You can then use a returned project ID with a read tool such as list_project_insights. When the token expires, obtain a new one using the same client credentials.

Troubleshoot access and update errors

• invalid_client from the token endpoint. Check that the client ID and secret belong to the same key and that the key is still active.
• 401 Unauthorized on an API request. Check that you sent the access token in the bearer header and that it hasn’t expired. For a project-specific request, also check that the credential can access the project.
• 403 Forbidden when adding, updating, or deleting. Check the account key’s access level and your role in the target project. For example, an account key with Read, add, and update can add a note where your role permits it, but a delete requires the higher access level.
• Fields changed unexpectedly after an update. For replacement-style updates, retrieve the current record first and send the complete editable payload. Include the current values of fields you want to keep. Omitted fields may be cleared or reset.

If you’re planning a multi-project integration and want to walk through which credentials and permissions fit your workflow, schedule a StratNav demo.