ViralGen exposes three kinds of keys: the Shortcut token that lets the iOS Shortcut pull your next scheduled reel, the MCP connection that lets Claude drive your pipeline in chat, and, on Agency, bring your own keys for the underlying AI providers so your generation runs on your own provider accounts.
The Shortcut token
A read only token, minted from Settings → iOS Shortcut, authenticates the Shortcut when it calls /api/shortcuts/next-reel. It only serves the next due, scheduled reel. It cannot generate, spend credits, or change anything else. Paste it into the Shortcut once during setup.
Bring your own keys (Agency)
Agency is bring your own keys: you supply your own provider keys, WaveSpeed (for Qwen images and Seedance/Kling video) and RunningHub, and generation runs against your accounts. Usage is metered per provider so you can see image calls, video seconds, and cost by provider.
MCP — beta
MCP, the Model Context Protocol, is the standard way to plug an app into an AI assistant. Connect ViralGen once and Claude can drive the pipeline in chat: read your queue and schedule, import and queue reels, draft and approve prompts, pick images, start rendering, and schedule slots. Included with Professional and Agency, and only the account owner can set it up. The full walkthrough lives in the app under MCP in the left sidebar.
Connecting from Claude — no key to handle
In Claude, add a custom connector and paste the server address https://www.viralgen.ai/api/mcp. Leave every other box empty: no client ID, no secret, no key. Claude registers itself, then opens a ViralGen approval page in your browser where you choose what it may do and set a spending cap. Click Allow access and it is connected. You never see or paste a token. The connection lasts 180 days and then asks to be renewed.
Connecting a tool that needs a key instead
Claude Code and anything else where you edit a config file yourself use a key. Create one under Settings, API keys, tick only the permissions you need, and copy it when it is shown — that is the only time it exists in readable form. It travels on every request as the header Authorization: Bearer followed by the key. In Claude Code: claude mcp add --transport http viralgen https://www.viralgen.ai/api/mcp --header "Authorization: Bearer vgk_YOUR_KEY".
What to know before you connect
It spends real credits on its own, so every connection carries a spend cap — leave it on, it is the only thing between a leaked key and your balance. Watch the permissions on the approval screen: an app can ask for the credit-spending one in advance and arrive with it already ticked. Emptying the cap box means no limit, not zero — type 0 if you want it unable to spend. Refunded work returns credits to your balance but not headroom to that cap, which clears when the 30 day window rolls over. And it is beta: tool names and responses can still change.
