This article is for org admins configuring Access via login — the recommended way for:

• zeroheight admins/editors, and
• viewers who access your design system in zeroheight via SSO

to connect AI tools to the design system context in zeroheight.

If viewers of your design system can't sign in via SSO, they can use Access via link instead — see Set up MCP access via link. Not sure which to use? Start with the zeroheight MCP overview.

Organization settings

Go to Your organization → MCP (or use the zeroheight MCP shortcut in your profile menu).

Access via login is toggled on by default. This means zeroheight admins/editors and viewers who access your design system in zeroheight via SSO can connect AI tools to your organization's styleguides via MCP. Access to individual styleguides is managed at the styleguide level.

Click Edit next to any styleguide in the MCP styleguide access table to manage its settings.

Enable write access under Enable MCP write is also on by default. It lets AI tools connected by admins and editors create and update pages. Viewer connections stay read only. Learn more about writing to zeroheight via MCP.

Styleguide settings

In styleguide settings, go to MCP and select the Access via login tab.

By default, Enable this styleguide for MCP – Access via login is toggled on for each styleguide. The exception is styleguides set to private and password-protected, where it is disabled by default.

Note: this setting also applies to partner connectors like Figma Make. Disabling it blocks those connections too.

This setting doesn't affect connections that use API credentials. See Connect with API credentials (CI/CD) below.

Share access with your team

The connection details for Access via login are identical for all your viewers: https://mcp.zeroheight.com/mcp

But to make sharing access easier, you can add the details to your styleguide using the remote MCP details block.

You can add a Remote MCP details block to a page in your styleguide so that viewers are able to see instructions for connecting to the MCP from the styleguide.

1. Open the slash inserter on any page, select Remote MCP details and select Access via login
2. Optionally configure which client tabs are visible using the block's settings

3. Optionally turn off Display help message if you're providing your own setup guidance

   

You can also grab the MCP connection details when you click Share in your styleguide:

Connect the MCP to your AI tool

For Cursor, VS Code, Claude Code, Codex and Kiro, one-click and copy-paste installation commands are available under Styleguide settings → MCP, in the remote MCP details block, and in the Share modal.

If you're using Figma,  ChatGPT/Codex or Claude connect via the respective partner connector.

For all other tools, see their documentation:

Claude Code · VS Code + GitHub Copilot · GitHub Copilot CLI · Windsurf · Zed · JetBrains AI · Gemini CLI · Opencode · Amazon Q · Kiro · Copilot Studio · Bolt · Cursor

When you attempt to connect, you'll be redirected to your browser where you'll need to log in to your zeroheight team.

If allowed, zeroheight admins/editors can log in via username/password or SSO. Viewers must log in via SSO. Once redirected to your browser:

1. Click the Sign in with zeroheight button
2. Enter your zeroheight team subdomain (accessible via the remote MCP details block or share modal)
3. Sign in via the SSO provider

4. Approve the connection

   

You'll then be redirected back to the tool you were connecting to.

Connect with API credentials (CI/CD)

Use API credentials when nobody can sign in through a browser, for example in a CI/CD pipeline that reviews every pull request against your design system. For a worked example, see Auditing every pull request against your design system.

Your AI tool connects to the same URL, https://mcp.zeroheight.com/mcp, and sends a zeroheight API Client ID and Access Token as request headers instead of signing in.

1. Create a Client ID (starts with zhci_) and Access Token (starts with zhat_). See the API authentication guide.
2. Store both as secrets in your CI system, for example as GitHub Actions secrets named ZEROHEIGHT_CLIENT_ID and ZEROHEIGHT_ACCESS_TOKEN.
3. Add the MCP server to your AI tool with two headers: X-API-CLIENT set to the Client ID, and X-API-KEY set to the Access Token.

In Claude Code:

claude mcp add --transport http zeroheight https://mcp.zeroheight.com/mcp \
  --header "X-API-CLIENT: $ZEROHEIGHT_CLIENT_ID" \
  --header "X-API-KEY: $ZEROHEIGHT_ACCESS_TOKEN"

In Codex, add this to config.toml:

[mcp_servers.zeroheight]
url = "https://mcp.zeroheight.com/mcp"
env_http_headers = { "X-API-CLIENT" = "ZEROHEIGHT_CLIENT_ID", "X-API-KEY" = "ZEROHEIGHT_ACCESS_TOKEN" }

Connections that use API credentials work differently from signed-in connections:

• They're read only, even if the API token has write scopes.
• They can read private pages.
• The Access via login settings for your organization and for each styleguide don't apply to them. They reach every styleguide the API token can access. To stop a connection, revoke its API token.
• The API token belongs to your team, not to the person who created it. Any editor can manage or revoke it.

Security and authentication

Access via login uses OAuth 2.1 with PKCE. Each person signs in with their own zeroheight account, either via username/password (admins/editors, if allowed) or via your SSO provider, such as Okta. Signed-in connections don't use a shared API key or long-lived static token. Connections that use API credentials are the exception, and the points below don't apply to them.

• Per-user access: the AI tool acts as the signed-in person. It can only reach styleguides that person can already see in zeroheight, and only those with Access via login turned on.
• Short-lived tokens: access tokens for admins and editors expire after 2 hours and are refreshed automatically. Viewers who sign in via SSO get a 7-day session with no refresh. When it ends, they sign in via SSO again.
• Checked on every request: zeroheight re-validates the token and your MCP settings on every call. If you turn off Access via login for your organization or a styleguide, or remove a user from your team, their signed-in connections stop at their next request.
• Read-only for viewers: viewer connections can only read documentation. Admins and editors also get the write tools, unless your organization has turned off Enable write access under Your organization → MCP. Learn more.
• Stored securely: zeroheight stores only hashed tokens, never the tokens themselves.

Connecting to multiple styleguides

When you sign in using Access via login, one connection reaches every styleguide that has Access via login enabled under Styleguide settings → MCP.

If you want viewers who sign in with SSO to have access to different styleguides, check out the documentation for SSO viewer groups.