Your agent needs to turn a customer's hour-long webinar into ranked vertical clips, fix the captions, and queue the best three for Friday. OpusClip ships two ways to do that: a hosted Model Context Protocol (MCP) server and a REST API. They are not interchangeable. The tool surfaces overlap but split on editing, generation, and cleanup. The auth models differ, and the surface you reach decides whether a publish call commits or waits for a human. In a multi-tenant product, every customer also brings their own OpusClip organization, credits, and caps. Here's how to pick, and how to wire either path into a production agent.
Same vendor, same credit pool, two different contracts.
OpusClip runs a hosted, remote MCP server over Streamable HTTP at mcp.opus.pro/mcp. It is maintained by OpusClip and listed in the official MCP Registry as io.github.opus-pro/opusclip, so there is nothing to deploy. Authentication is OAuth only: the user signs in to OpusClip in a browser and picks an organization on the consent screen. Any account can complete OAuth and read the catalog, but calling a tool requires a Pro Beta, Max, or Business plan. OpusClip documents 13 read tools, 14 write tools, two deprecated signposts, and two thumbnail-generation tools. A separate Claude Connector serves Claude.ai with the 29 workflow tools and no generation tools.
The REST API lives under api.opus.pro/api. It covers projects (POST /api/clip-projects), clips (GET /api/exportable-clips), brand templates, censor jobs, transcripts, thumbnail generation, collections, and social posting. Authentication is an organization-level API key from the OpusClip dashboard, sent as Authorization: Bearer <API_KEY>, with an x-opus-org-id header for users who belong to more than one organization. API access requires the same Pro Beta, Max, or Business plans, and core project and clip endpoints allow 30 requests per minute per key. Project completion can trigger a signed webhook through conclusionActions.
Four dimensions change what you build: what the agent can do, how it authenticates, what you operate, and which workloads fit.
Most of the clipping workflow exists on both surfaces. The last column is the 30-tool surface Scalekit's connector exposes.
The most consequential gap is editing. opusclip_edit_clip takes an ordered list of operations such as remove_filler_words, trim_section, replace_phrase, set_style, and undo, applies them in one call, and triggers a single preview re-render. A dryRun flag reports what a batch would change without saving it. OpusClip's API overview routes clip editing to the MCP documentation, and the published REST endpoints have no equivalent. opusclip_analyze_video adds keyframe-level evidence about faces, screen regions, and the active speaker, and spends no credits. An agent that reasons about a clip before cutting it needs both tools, which means MCP. Scalekit's connector also includes opusclip_preview_clips, which renders clip cards on hosts that support MCP Apps.
The API owns cleanup and verifiable plumbing. Deleting a collection and removing a clip from one exist only as REST endpoints. Completion webhooks are signed: X-Opus-Signature is an HMAC-SHA256 over the raw body plus X-Opus-Salt, keyed with the organization's API secret. An OAuth-only integration never holds that secret, so it cannot verify those signatures. Thumbnail generation exists on the REST API and on mcp.opus.pro, but not in the 30 tools Scalekit's connector exposes. If thumbnails are core to your agent, plan the REST path for that step.
The MCP path is OAuth only. The user completes a browser consent flow and selects one OpusClip organization, and that choice is fixed for the life of the connection. There is no list_orgs tool; switching organizations means disconnecting and reconnecting, and opusclip_whoami reports which organization a session is bound to. For B2B agents that is a clean model: one connected account maps to one customer workspace. It also means consent needs a human in a browser once. After that, tokens refresh without the user, so later runs can be headless until a refresh fails or the grant is revoked.
The REST path skips OAuth. Each customer generates an organization-level API key in the OpusClip dashboard, and every request carries it as a bearer token. Headless pipelines work from the first run, with no consent redirect. The cost is custody. The key is long-lived and organization-wide, carries no user identity, and OpusClip documents no per-endpoint scopes for it. The same secret signs webhooks, so rotating it means updating verification too. OpusClip's own guidance warns against pasting API keys into agent chat, because transcripts, logs, and model context retain them. For a deeper look at why static credentials break in production AI systems, the tradeoffs go beyond just OpusClip.
Both paths require per-user credential isolation in a multi-tenant B2B agent. MCP's OAuth flow gives you a token per connected user, bound to one organization. The API gives you a key per customer organization. In neither case does the path itself solve storage, rotation, or revocation; those are infrastructure problems regardless of which path you choose. OpusClip's per-workspace caps turn isolation into a billing problem too. A misrouted credential spends another customer's 900 monthly credits.
The MCP path hands you tool schemas that OpusClip maintains and a server that normalizes the API behind them. It does not hand you token storage, refresh-failure handling, revocation, or tenant isolation. The REST path hands you only the endpoints: request construction, retries, polling, webhook verification, and credential lifecycle are yours. On both paths, three OpusClip behaviors dominate day-to-day operations.
opusclip_submit_project returns a project ID immediately, and clips arrive minutes later. opusclip_list_clips carries the project's stage, and an empty list during processing is not an empty result. Re-renders after opusclip_edit_clip or opusclip_create_censor_job return render_pending: true, and reading preview_url before it clears fetches the old render. opusclip_analyze_video starts a task that must be polled with its task_id. Letting the model drive those polls burns tokens every turn. Pass webhookUrl on submission, or poll in code and hand the agent finished state.
When a workspace exhausts its 900 monthly credits, OpusClip returns 403 with API_MONTHLY_CAP_REACHED and a reset_at timestamp. It is deliberately not a 429, so agent frameworks don't retry in a loop. A 429 with X-Cap-Reason: concurrent means four projects are already in flight, and backoff is the right response. The REST social posting endpoints have their own limits, one request per second for posting and scheduling, and each post to X costs one credit. Call opusclip_get_usage before a batch instead of discovering the cap halfway through it.
MCP tool schemas change when OpusClip ships. The editing-script tools were retired in favor of opusclip_edit_clip, and OpusClip kept the old names as no-op signposts so agents holding stale tool lists get redirected rather than erroring. That is considerate, but a cached list can still point the model at dead tools. Pin an explicit tool allowlist on the MCP path and leave opusclip_get_editing_script and opusclip_apply_editing_script out of it. The REST reference publishes OpenAPI definitions per endpoint, which gives you a contract to diff against.
Every customer in your product has their own OpusClip organization, credits, and caps. Fifty customers means fifty OAuth grants or fifty API keys, each with its own lifecycle.
The MCP path gives you a token per connected user, bound to one organization at consent. The API path gives you a long-lived key per customer. Either way, the credential must be encrypted at rest, isolated per tenant, never logged, and revocable when a customer disconnects. Refresh can fail and grants can be revoked from OpusClip's side, so your agent has to detect that and route the user back through consent instead of failing silently. A key pasted into a support ticket or a prompt keeps spending someone's credits until it is rotated. Understanding credential ownership across agent tool-calling patterns is essential before choosing either path.
Scalekit's OpusClip MCP connector handles the OAuth 2.1 flow with Dynamic Client Registration (DCR), token storage, and refresh, and a custom bearer connector keeps API keys in the same vault for the REST path. The MCP vs API decision doesn't change your auth infrastructure. Each call resolves the connected account of the user who triggered it, so what the user can't do, the agent can't do. Credentials never touch the agent runtime.
Recommended reading: Migrating from API keys to OAuth for MCP servers
The examples below use Python throughout: the Claude SDK for direct tool calling and LangChain for the Virtual MCP path. Python is the right default here because Virtual MCP session tokens are minted from the Python SDK; the Node.js SDK does not create them yet.
You need a Scalekit environment, an OpusClip MCP connection under AgentKit > Connections, and an end user whose OpusClip organization has API access. Credentials come from Developers > API Credentials in the Scalekit dashboard; the AgentKit quickstart walks through setup.
The connection_name in every call must match the connection name configured in the Scalekit dashboard exactly. The OpusClip MCP connector docs use opusclipmcp; if you named the connection differently, use your name.
Create or fetch the connected account for the user. If it isn't active, send them through the authorization link. OpusClip's consent screen is where they choose the organization the agent will act in, so confirm it with opusclip_whoami afterward.
This is not a flat catalog load. list_scoped_tools returns the tools the current user's connected account is authorized to call, and the tool_names filter narrows that to what this agent role needs. A clipping agent doesn't need all 30 OpusClip definitions in context. At the roughly 200 tokens per tool Scalekit uses as a planning estimate, the full catalog costs about 6,000 tokens per turn before the agent does any work. OpusClip's descriptions are unusually detailed, so treat that as a floor.
Execution goes through execute_tool. Scalekit resolves the connected account for IDENTIFIER and makes the call, so the agent never holds an OpusClip token. Upstream OpusClip errors raise ScalekitToolException. The loop passes the error code and message back to the model, so a cap-reached error ends the task instead of triggering retries.
For the same pattern with other connectors, see the Anthropic example.
The direct path keeps tool scoping in your code. A Virtual MCP server moves it into configuration: one scoped endpoint per agent role, one short-lived session token per user per run, and no MCP server to deploy, host, or maintain.
Define which connections and tools the role can see. The publisher role below can read clips and prepare scheduled posts, but it cannot submit projects, edit clips, or run censor jobs.
Save config_id and mcp_server_url and reuse them for every user. Adding Slack for approval notifications or Google Drive for source videos is another McpConfigConnectionToolMapping in the same list. The full lifecycle is in Set up and connect a Virtual MCP server.
Before each run, confirm the user's connections are active, then mint a token scoped to that user. Tokens default to about one hour, and there is no refresh endpoint; long-running hosts call create_session_token again before expiry. The example uses ChatOpenAI as in Scalekit's LangChain guide; any chat model with tool binding works.
A content operations product might run three roles against the same customers: a clipper that submits and edits, a publisher that schedules, and a reporter that only reads. Each role gets one Virtual MCP server, and each run gets a token for one user. The publisher above cannot call opusclip_submit_project, so an instruction smuggled into a video title can't spend credits through it. The endpoint is static; the identity is per-user. Pair the publisher with a Slack connection and it can drop each approval_url into the customer's channel for sign-off.
Recommended reading: Access Control for Multi-Tenant AI Agents and How Tool Calling Auth Changes When You Move from Single-Tenant to Multi-Tenant
Scalekit's catalog ships OpusClip as an MCP connector. For the REST API, add your own connector. Scalekit stores each customer's OpusClip API key in the vault and proxies requests, so the key never enters your database, your agent runtime, or the model's context.
OpusClip expects the key as a bearer token, so the BEARER auth pattern fits. REST connectors are created through the management API, as described in Create your own connector.
Create a connection for the connector, and have each customer supply their key through the same authorization-link flow as Step 1. actions.request() then proxies calls with that customer's credential, and path is relative to proxy_url. See Making tool calls for the full model.
Clip records carry a composite id of {projectId}.{clipId}, while the social posting endpoints expect the bare clip ID, which is the curationId field. Posting and scheduling endpoints allow one request per second, so batch schedulers need a queue. Webhook verification needs the customer's API secret, which on this path lives in Scalekit's vault rather than your app. Decide where verification happens before enabling conclusionActions, or track completion by polling instead.
Agent failures are quiet. A lapsed consent, a workspace at its cap, and a post waiting on approval all look the same from the outside: the agent did nothing.
Every execute_tool call returns an execution_id, and upstream failures raise a ScalekitToolException carrying tool_error_code, tool_error_message, and execution_id. In the dashboard, AgentKit > Connected Accounts shows each account's status, refresh history, and tool execution logs. You can answer which user's OpusClip call failed, when, and with what upstream error. That is the downstream audit trail a raw token or API key in your own database doesn't give you. For a broader look at agent tool observability and whether your agent is actually working, the same patterns apply across any connector. For authentication events across your environment, see Audit Trails for Agent Auth in B2B SaaS.
If your agent edits clips conversationally, analyzes footage before cutting, or lives inside an interactive host, build against OpusClip MCP. The editing and analysis tools are MCP-only, OpusClip maintains the schemas, and approval-gated publishing is the right default for anything touching a customer's social accounts. If your agent is a deterministic ingestion pipeline that needs signed webhooks, collection cleanup, thumbnails, or request-level retry control, use the REST API. Many OpusClip products will run both: a REST pipeline that ingests every new episode and an MCP-backed assistant that edits and schedules on request. Either way the credential problem is identical, and that is what needs production-grade infrastructure.
Start with the OpusClip MCP connector docs for the full tool list and quickstart. Then browse the Scalekit connector library for the sources and destinations your agent pairs with OpusClip, including YouTube, Vimeo, Google Drive, and Slack. Comparing video tools? Read how LangChain tool calling works and where it stops for the framework-level view. For the per-user auth pattern in working code, fork an agent template such as the Slack triage agent. Plans are on the pricing page.
Building an OpusClip agent and want help with the auth design? Talk to us for immediate help.
