Do I need my own X Ads developer app to use NotFair?
No. NotFair hosts the X Ads API credentials. You authorize an existing ads account; you do not stand up an X developer app for the MCP client.
X Ads MCP · hosted OAuth
Connect X Ads to an AI client without building an app
NotFair hosts the X Ads API credentials. You authorize an existing ads account; you do not stand up an X developer app for the MCP client.
Last verified · September 17, 2026 · NotFair product team
Two identities, one flow
OAuth identifies the user; the hosted integration identifies the app
Self-hosted servers make the operator own both layers. A hosted server separates them: NotFair maintains the X Ads application integration, while the customer grants scoped access as the account owner.
- 01
Add the hosted MCP URL
Use the same Streamable HTTP endpoint in Claude Web, Claude Code, Codex CLI, Cursor, OpenClaw, Hermes, or another compatible client.
- 02
The client discovers OAuth metadata
The MCP resource advertises its authorization server. Discovery uses the exact apex or www origin requested so the issuer remains byte-for-byte consistent.
- 03
Sign in and authorize X Ads
The browser-facing flow asks the account owner to approve access. Passwords are never pasted into the MCP client.
- 04
Choose eligible accounts
NotFair lists reachable accounts for the authorized user. The user chooses the intended scope.
- 05
Return to the AI client
The client completes its OAuth code exchange. Platform credentials stay on the hosted service.
- 06
Verify with a real read
Ask the agent to list connected X Ads accounts, then inspect one entity before staging any write.
Evidence table
Hosted OAuth versus self-hosting
| Responsibility | NotFair hosted MCP | Self-hosted X Ads MCP |
|---|---|---|
| Provider application | Operated by NotFair | Created and maintained by your team |
| OAuth application | Hosted authorization flow | Your team creates credentials and redirect URIs |
| MCP runtime | Remote Streamable HTTP endpoint | Local or cloud process you deploy |
| Account consent | Customer still approves provider access | Customer approves access to your OAuth app |
| Secrets | Platform tokens remain server-side | Your team stores and rotates credentials |
| Updates | Service maintained by NotFair | Your team tracks API and MCP changes |
Limits and honest boundaries
- The X Ads user still needs legitimate access to the accounts they select.
- Hosted OAuth removes customer infrastructure work; it does not bypass provider permissions, policies, or API restrictions.
- Claude, Codex, and other clients may present connector settings differently even though the remote MCP URL is the same.
- The apex endpoint is canonical for new connections; www remains supported so existing OAuth grants keep working.
Frequently asked questions
Does the AI client receive my platform refresh token?
No. The hosted service keeps platform credentials server-side. The MCP client receives tools and results, not your password or raw refresh token.
Do both notfair.co and www.notfair.co endpoints work?
Yes. The apex origin is canonical for new setup, while both origins remain valid OAuth and MCP resources for backward compatibility.
Is this the same as Google Ads without a developer token?
The pattern is the same — NotFair hosts the application credentials — but Google Ads developer tokens are specific to Google Ads. This page is about X Ads OAuth only.
Continue evaluating