OrbitPage AI, MCP and ChatGPT

The same safe page workflow is available through three different entry points.

Use the dashboard AI assistant when you are already editing in OrbitPage. Use the personal-token Automation REST API for scripts, n8n, CI or a trusted backend. Use the remote MCP server when you want ChatGPT or another compatible client to read, preview, apply, publish or restore one connected workspace.

The public-site support chatbot is separate. It cannot edit a workspace and does not share the MCP OAuth grant or the personal Automation API token.

• Dashboard AI: Firebase session, App Check and an explicit preview confirmation.
• Automation REST API: a revocable personal token bound to one workspace and selected scopes.
• Remote MCP: OAuth access bound to one selected workspace and tool-specific scopes.

A request becomes a proposal before it becomes page content.

OrbitPage sends bounded page context to the configured model and asks for structured operations. The server validates the result against the page schema, role, plan, moderation and current revision before it creates a short-lived preview.

Nothing changes when a preview is rejected or left unused. Applying an approved preview rechecks the revision and permissions, creates normal version history and can publish the exact result. If someone edited the page in the meantime, OrbitPage returns a conflict instead of overwriting the newer work.

The ChatGPT connection is intentionally narrower than the complete API.

The production Streamable HTTP endpoint is https://orbitpage.com/mcp. Its tools identify the connected workspace, read page content and capabilities, prepare and apply reviewed changes, publish an exact revision, inspect publication status, list retained versions and restore a selected version into a private draft.

It does not expose billing, Shop checkout, newsletters, domains, media upload, team administration or internal operator actions. The wider Automation API is the correct contract for supported external workflows in those areas.

Connect the live MCP server manually while the directory plugin is under review.

Open ChatGPT Settings > Security and login and enable Developer Mode. Then open ChatGPT Plugins, select the plus button and create a custom connection with Server URL https://orbitpage.com/mcp. Choose OAuth with automatic discovery. OrbitPage supports dynamic client registration, so you do not enter a client secret.

Save the connection, start sign-in, authenticate with your normal OrbitPage account and choose one eligible workspace on the consent screen. Review the requested permissions before approving. The exact ChatGPT menu names can change; use OpenAI's current connection guide if the interface differs.

• Use the production HTTPS endpoint, not a Preview deployment or local URL.
• Do not paste a Firebase password, personal API token or OpenAI API key into the connector settings.
• Confirm the grant later under OrbitPage Dashboard > Account > Connected apps.

ChatGPT receives a revocable grant, not your OrbitPage credentials.

ChatGPT discovers OrbitPage's protected-resource and authorization-server metadata, registers as a public OAuth client and uses authorization code with PKCE S256. The browser login remains protected by Firebase Authentication and App Check. The consent step binds the resulting grant to the selected user, tenant, page and scopes.

Access tokens are short-lived and refresh tokens rotate. OrbitPage stores credential hashes, verifies the exact MCP resource and scopes on every tool call, and rechecks current workspace membership. Changing the active dashboard workspace does not retarget an existing grant; disconnect the app and connect again when you need a different workspace.

• workspace:read reads workspace identity, page content, theme and capabilities.
• publication:read reads publication state and the public URL.
• ai:write prepares and applies reviewed AI page changes.
• publication:write publishes an approved page revision.
• backup:read lists retained published versions; backup:write restores one into a private draft.

Keep proposal, private draft and public page as separate states.

Ask ChatGPT to read the affected section and preview a specific change. Review the returned summary, then approve only that proposal. A normal apply publishes the approved revision and reports success only after managed publication is complete.

If you explicitly want a private draft, ask ChatGPT to apply without publishing. Review the saved revision separately, then approve publication of that exact revision. Restoring history also stays private until a separate publish instruction is confirmed.

• Safe prompt: Preview a clearer profile description, keep my links and theme unchanged, and do not apply it yet.
• Status prompt: Show my connected workspace and tell me whether it has unpublished changes. Do not modify anything.
• Publish prompt: Show the current private revision, then publish that exact revision only after I confirm.

Submitted, approved and published are different states.

As of 5 August 2026, the OrbitPage plugin has been submitted to OpenAI and is under provider review. It is not yet approved, published or available in the Plugins Directory. The manual Developer Mode connection remains the available ChatGPT setup for testers and developers.

OpenAI approval will not publish the plugin automatically. After approval, OrbitPage must deliberately publish the approved version in the submission portal before users can find it in the universal directory shared by ChatGPT and Codex.

Diagnose discovery, login, scope and publication as different layers.

An OAuth configuration error usually means ChatGPT could not read a well-known metadata document as public JSON. A successful login with a reconnect request usually means the grant lacks a tool scope. A missing logo can be cached connection or listing metadata rather than an MCP failure.

After a write, ask for publication status and compare the draft and published revision before judging the public page. If the connection targets the wrong workspace, revoke it from Dashboard Account and reconnect; never try to supply tenant or page IDs in a prompt.

Grant only the workspace and capabilities you intend to use.

The connected ChatGPT service receives only the data returned by the tools you authorize and processes it under its own terms. OrbitPage does not send your Firebase password or personal API tokens to the MCP client, and tool responses should never contain credentials or unrelated customer data.

You can revoke the entire connection from Dashboard Account. Use a dedicated, fictional workspace for demonstrations and review material, and verify the current OrbitPage privacy policy before connecting production content.