Scrollport supports three connection methods. MCP is optional: an agent with authenticated HTTPS requests and a persistent secret store can use the direct API, without a shell or MCP registration. Give your agent the setup prompt and it will automatically choose the best fit for its environment. Reuse a working connection first.
| Connection | Best for | What the client stores |
|---|---|---|
| CLI and device code | Agents with a persistent writable shell. | A scoped Scrollport key in the local credential store. |
| Remote MCP and OAuth | Supported chat clients and coding agents. | An OAuth connection managed by the client. |
| Direct API and device code | Agents with authenticated HTTPS requests and a persistent vault or secret store. | A scoped Scrollport key in that store, available to authorised future sessions. |
Start automatically
Use the same prompt shown on the website:
Read https://scrollport.com/start and then help me set up Scrollport.The agent first reuses an existing Scrollport connection when one is available. Otherwise it prefers the CLI on a persistent writable shell, Remote MCP for a compatible client, or the direct device API for a runtime with authenticated HTTPS and secure storage. Check the direct API route before reporting incompatibility. A temporary runtime backed by a persistent vault qualifies; the agent does not need its own persistent filesystem.
What you do
- Sign in with Google or with a code sent to your email.
- Create a Scrollport account if you do not already have one.
- Review the request and authorise the agent's access.
Signing in identifies your account. It does not give the agent access until you separately approve the request.
CLI and device code
With a shell, the same journey starts with:
npx scrollport setup- The agent requests a device grant with the fixed scopes
discover,inspect,run,wallet,appsandfiles. - Scrollport returns a verification link, a short user code, a device code and a polling interval.
- A signed-out human opens the link, checks the request, and selects Sign in with Google or Sign in with email. Authentication returns to the same still-pending request and grants nothing.
- The signed-in human checks the account, matching code and scopes, then separately selects Authorise agent or denies the request.
- The agent polls until it receives the scoped API key, then checks the wallet.
Match the code shown by the agent with the code in the browser. Nothing is granted until you approve.
Remote MCP
Remote MCP uses OAuth, so there is no API key to copy. Choose your client in the Remote MCP guide.
Direct API for headless runtimes
Use the direct API and no-shell guide when CLI or MCP setup is unavailable and the runtime can make authenticated HTTPS requests and retain its key securely. The guide covers device authorisation, storage and a free verification request.
For manual key placement, endpoint configuration, rotation and revocation, see credentials and configuration.