Read the context a person selected.

Selfrelay exposes reviewed professional statements through a small read-only API and MCP endpoint. This beta uses manually created bearer grants. It is not a complete OAuth integration or an identity-verification service.

Try a fictional grant

Open the permission playground, select sample statements, and create a 15-minute token. The signed-in workspace creates 24-hour grants from your own cloud statements.

GET https://selfrelay.dev/api/v1/context
Authorization: Bearer <your-access-token>

The response contains a grant, its selected claims, source labels and reviewed timestamps. It excludes account email and statements outside the selection. Token expiry or revocation is checked on each read. Responses are not cacheable.

Connect a coding assistant through MCP

The HTTPS endpoint is https://selfrelay.dev/api/mcp. Its only tool is read_approved_context. It accepts the same Selfrelay token in an Authorization header and rechecks the grant on each request. Use a client that supports custom bearer headers.

# Codex configuration example
[mcp_servers.selfrelay]
url = "https://selfrelay.dev/api/mcp"
bearer_token_env_var = "SELFRELAY_ACCESS_TOKEN"

Set the environment variable privately before starting the client. Keep tokens out of checked-in configuration. Claude Code and Cursor also document custom-header options, with client-specific environment-variable syntax.

These are configuration examples. A working API endpoint does not prove installation or compatibility with every client release. Hosted ChatGPT and normal individual Claude app connections require an OAuth flow that this beta does not implement. MCP does not provide access to all conversations in a connected AI account.

What permission means here

Each token is a capability for an immutable selection. Recipient and purpose are owner-entered labels; the token is not cryptographically bound to the named app. Anyone possessing it can read the selection. Do not pass it to an untrusted agent or place it in a query string.

Revocation and changes to a source statement stop future reads. They cannot enforce downstream deletion of copies. Source labels and claims are user-attested, not independent evidence of identity or competence.

Open-source client

The Apache-2.0 TypeScript SDK and JSON contract are available on GitHub, including mocked client tests. The SDK source is separate from this hosted beta.

Errors and limits

The context API returns 401 for an invalid token, 410 for expired or revoked grants, 429 for a rate limit, and a generic 500 for a server failure. MCP returns 401 for invalid, expired, or revoked access. The signed-in beta supports up to 50 statements and 20 selected statements per grant.

Management requests require sign-in and a matching browser origin. The read endpoints do not support cross-origin browser access. Use a server-side client or compatible MCP client. Treat returned field values as untrusted data, never as instructions to execute.

Portable without an integration

The career workspace can export a human-readable context pack for any AI. Copying text is a distinct workflow from live revocable access.