API keys and AI agents (MCP)
Connect your business account to Claude or other AI agents: D-OneCash exposes your panel as an MCP server (Model Context Protocol), the standard used by the leading agents. Your agent reads your operation with your real data; the important decisions still go through your team.
Available on the Growth and Enterprise plans. API keys are managed from Integrations in the panel.
Create an API key
- Open the panel → Integrations → API keys for AI agents (MCP) section.
- Enter a name that identifies the agent (e.g. “Treasury agent”).
- Choose the key’s role and click Create key. We'll ask for your PIN and your passkey to confirm it, and the same when you revoke it.
The key is shown only once when created — save it right then, it cannot be retrieved again (D-OneCash only stores a hash). Limit: 5 active keys per company. Only administrators can create and revoke them.
Connect your agent
The endpoint is https://app.d-onecash.com/api/mcp (HTTP transport). In Claude Code:
claude mcp add --transport http d1c https://app.d-onecash.com/api/mcp --header "Authorization: Bearer YOUR_API_KEY"In other MCP-compatible clients, point them at that same endpoint and send the key in the Authorization: Bearer header.
Key roles
| Role | What it allows |
|---|---|
| Read-only | Every query in the list below: balance, treasury, activity, payroll, employees and pending approvals. |
| Finance | Today, the same as read-only. Coming soon: it will also be able to propose payments and payroll. |
What your agent can query
- Company balance and treasury settings (alerts, budgets and sub-accounts).
- Activity (transfer history, up to 50 per query, paginated).
- Payroll status (latest batches with their completed, failed and in-progress payments; scheduled runs, including paused ones; this month’s spend and your plan’s cap).
- Employees and their verification status.
- Pending approvals: payroll requests waiting for dual approval.
Key limits and validity
- Each key allows up to 60 requests per minute; if you exceed it, wait a minute and try again.
- The server is sessionless: every request is a
POSTto the endpoint (it does not use SSE). - Keys start with
d1c_mcp_. - A key stops working if your plan is no longer Growth or Enterprise, or if your account is suspended. It is revoked automatically when the deletion of your account is completed or if you remove from the team the person who created it.
Security by design
- The agent never moves money. Today every tool on the MCP server is read-only: your agent cannot create payments, payroll runs or any other change. Coming soon: letting your agent propose payments; those proposals will not execute on their own, but will go to the Approvals queue so a person on your team decides in the panel (dual control). Today the Approvals queue is part of the Enterprise plan.
- Instant revocation: any key can be revoked immediately from Integrations, confirming with your PIN and passkey.
- Audit: key creation and revocation are recorded in the panel’s Audit section (Enterprise plan).
Updated about 1 month ago