Replit

Try the sign-in path first. Replit's pane can register itself with servers that support it, which means no key exists at any point — nothing to copy, nothing to paste, nothing to leak. What the pane offers varies by plan and workspace, so if the fields you see do not match, the header fallback is right below and works everywhere.

Setup — sign-in path

1. 1

   Open the Integrations pane and add an MCP server

   Pick the HTTP transport — it may be labelled Streamable HTTP or remote. Not stdio, and not an SSE-only option.

   Screenshot coming soon

   The Replit Integrations pane with the option to add an MCP server.

   /docs/agents/replit/step-1.png

2. 2

   Enter the URL and leave every auth field empty

   Server URL

   https://mcp.tiptapgames.com/mcp

   Empty is deliberate here. TipTap answers the first call by saying authorization is needed, and a client that understands that goes and gets it. Filling in a credential field stops that from ever happening.

   Screenshot coming soon

   The Replit MCP server form filled in with the TipTap endpoint URL and no headers or credentials.

   /docs/agents/replit/step-2.png

3. 3

   Approve the connection

   Your browser is sent to a consent screen on tiptapgames.com. Sign in if you are not already and press Approve; the browser returns to Replit, which finishes connecting and starts listing tools.

   The screen will label the client an Unverified app, and say it registered itself and chose its own name. That is expected for a client that self-registers, and it is telling you where the name came from rather than accusing Replit of anything. Check the address bar says tiptapgames.com and that you started this yourself a moment ago, then approve.

   Screenshot coming soon

   The TipTap consent screen on tiptapgames.com naming the Replit client, with Approve and Deny buttons.

   /docs/agents/replit/step-3.png

4. 4

   Prove it works before building anything

   Ask the Replit Agent

   Call the tiptap MCP server's `ping` tool and show me exactly what it returns.

   You should get back a line saying the service is reachable and your credential is valid. If ping fails, stop and fix the connection — the table below says what each failure means. A build started on a broken connection just wastes agent time.

   Once ping passes, hand it the prompt:

   Starter prompt

   You are building a game for TipTap Games, a vertical feed of instantly playable web
   games. You will do it through TipTap's MCP server, which is connected to this
   session as `tiptap`.
   
   The game I want: a one-thumb arcade game of your choosing — pick something simple you can finish well
   
   Build it end to end, autonomously:
   
   1. Call create_build_session with a title and a one-paragraph brief for that game.
      Use the session_id it returns for every call after this one.
   2. Call get_game_specification, then get_sdk_documentation. Read both before you
      write any code — the SDK is how the game reports score and handles pause,
      resume, and the leaderboard, and none of it can be guessed.
   3. Call list_categories so you can set a real category at submit. Unknown slugs
      are dropped silently. Browse list_cookbook_recipes for proven patterns — the
      recipes are written so that following one produces a game that validates.
   4. Write ONE self-contained .html file:
      - Inline every byte of CSS and JavaScript. No external scripts, styles, or fonts.
      - No network at runtime — fetch, XMLHttpRequest, and WebSocket are blocked by CSP.
      - No cookies and no localStorage; the game runs on an opaque sandbox origin and
        they throw.
      - Assets as data: or blob: URLs only. 5 MB maximum.
      - Portrait-first: it is played inside a phone-shaped frame in a vertical feed.
   5. Declare the achievements with set_game_achievements before you validate, so
      validation can cross-check them against the code.
   6. Call upload_game_draft with the HTML, then validate_game_draft. Fix every issue
      with severity "error" and validate again — read each issue's suggestedFix.
      Warnings are advisory.
   7. Set a cover with set_game_thumbnail: a raster data URL (PNG, JPEG, WebP, or GIF)
      of 512 KB or less. SVG is rejected, so rasterize first.
   8. Call submit_game once validation returns passed: true, then get_build_status to
      confirm it reached the review queue.
   
   Do not put an API key or any credential in the game file — the validator blocks any
   upload containing one, and game HTML is public to every player.
   
   Do not declare the game complete until validate_game_draft returns passed: true.
   
   submit_game sends the game for review. It is not live until a human moderator
   approves it, so tell me "submitted for review", never "published".
   
   Tell me every tool call you make and what it returned. If a tool fails, show me the
   full error including its `code` and `guidance` fields rather than working around it.

   To name the game yourself, type your idea into the starter prompt card on /create and copy the version it writes. Either way the agent opens the session on its first tool call — there is no session to create here first.

   Screenshot coming soon

   The Replit Agent chat showing the result of calling the TipTap ping tool.

   /docs/agents/replit/step-4.png

Fallback — an Agent Key in a custom header

Use this if the pane has no sign-in flow, or the sign-in path stalls. It is fully supported and verified working — just less pleasant, because you handle a token.

1. 1.Mint a key in Create → Agents & access, labelled so you recognise it later. Copy it immediately — it is shown once and cannot be retrieved afterwards.
2. 2.In the Replit MCP form, keep the same URL and transport, then add a custom header:

The value is the token exactly as minted — no Bearer prefix. Replit configures static tokens as user-defined headers and may not offer a literal Authorization field at all, which is exactly why this second header name exists. If your pane does give you an Authorization field, use that instead with the value Bearer <token>.

Set one auth header, not both. A request carrying an Authorization header and X-TTG-Agent-Key with different values is rejected outright rather than one being silently preferred — which is the kind of failure you would otherwise spend an hour on.

What each failure means

Replit's pane differs between plans, so this is the full list of what can go wrong and which half of the setup owns it.

Wherever a row says to use the handoff route: ask the agent for one self-contained HTML file and paste it at /create/upload. Same validator, same review queue.

Never paste an Agent Key into a Repl, a report, or a game file. The validator rejects any upload containing one, but that is a backstop rather than permission — if a key is exposed, revoke it in Create → Agents & access and mint another.