Purpose
How people and systems securely access Exterview, and how test and production stay separated.Access model
User login
Your team signs in using your company’s existing Microsoft account, so there’s no separate password to manage.
MCP client authentication
AI assistants such as Claude, ChatGPT, and Microsoft 365 Copilot connect
through the Exterview MCP server using OAuth 2.1 with Microsoft sign-in, and
act as the signed-in user. Upcoming: API-key access for system-to-system
integrations.
Role-based access
Permissions are scoped by role, so configure, run, and review are separate.
Data Visibility sets which records each role sees: organization, department,
or own records.
Environment separation
Test and production are isolated from each other.
Environments
FAQs
How do developers authenticate to the API?
How do developers authenticate to the API?
MCP clients authenticate with OAuth 2.1 and Microsoft sign-in, as the signed-in user. Upcoming: API-key access for system-to-system integrations. See API Authentication.
Can we test without affecting live data?
Can we test without affecting live data?
Yes. Sandbox is fully isolated from production.
Who controls access?
Who controls access?
Your administrators, through role-based access configured in Governance.
Related
- API Authentication. How system access is authenticated and scoped.
- Governance. Configure users, roles, and access.