# Set up Report Campaign Performance

This is a read-only composite, but it needs a model credential and every listed data source configured before it can run. Set up isolated test accounts or workspaces first, grant only the smallest read scope that exposes the test data, and store every credential only in Dome's secret inputs. Never put a key or secret in this repository, an agent prompt, or a chat message.

## Create the model credential

- Create an API key in the [Anthropic Console](https://console.anthropic.com/settings/keys).
- Enter the raw key as `anthropic_api_key` during import. Do not prepend `Bearer `.
- The template uses that key only for its managed `claude-sonnet-5` model connection.

## Create the provider credentials

- `google_oauth_client_id`: A Google OAuth client ID for an AI-powered agent.
- `google_oauth_client_secret`: The Google OAuth client secret.

For a provider that asks you to register a manual OAuth app, use this callback URL exactly:

`https://api.domesystems.ai/oauth/callback`

## Set up each connected provider

### Amplitude

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test Amplitude user that can view only the required projects. This composite uses the US endpoint and read-only OAuth; confirm project access with `get_amplitude_context`.

### PostHog

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

PostHog's hosted MCP server supports OAuth. This composite uses the upstream
`readonly=true` option, which removes write MCP tools from the session.

- After import, complete shared OAuth as a dedicated test member and select the
  intended organization and project. Verify a known test insight or event is
  visible and another project is unavailable.

PostHog's MCP exposes a generic `exec` tool, so tool-name filtering alone is
not a complete read-only boundary. Keep the upstream read-only setting, and pin
the connection to one project when production use requires a fixed boundary.
For a headless connection, use a separate personal API key with PostHog's MCP
Server preset instead of modifying this OAuth template.

### Connect Ahrefs

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

Ahrefs' hosted MCP server is read-only, and each request consumes API units.
It is available on Ahrefs Lite and higher plans. Use the official
[Ahrefs MCP guide](https://docs.ahrefs.com/en/mcp/docs/introduction) for the
current endpoint, plan limits, and vendor-specific setup details.

## Recommended: OAuth consent

OAuth is the normal way to connect an Ahrefs account to an MCP-compatible AI
client. Ahrefs creates a dedicated API key with the `MCP` scope after consent.

Start the shared Ahrefs OAuth connection after importing this composite, sign in
to the intended account, and approve the consent screen. Confirm that the
resulting connection appears in Ahrefs' API keys report; workspace
administrators can adjust its per-key API-unit limit there. Then test with
“Show the top organic pages for example.com” or “What are the remaining API
limits?”

OAuth-created MCP keys default to a 200,000 monthly API-unit limit per key.
The workspace plan limit still applies.

## Alternative: Manually generated MCP key

Use this option when a shared, non-interactive connection is required.

- In Ahrefs, generate an MCP key for the intended account.
- In Dome, create a separate API key/token tool connection instead of using
  this OAuth template.
- Send the static credential as `Authorization: Bearer <MCP key>`.
- Keep the value out of source control and local `.env` files, and rotate or
  revoke it in Ahrefs when access should end.

## Alternative: Enterprise API key

Enterprise customers can connect with an Ahrefs API key instead. Create a
separate API key/token tool connection and send
`Authorization: Bearer <API key>`. API keys and MCP keys are not
interchangeable, so use the credential type appropriate to the selected flow.

### Netlify

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test user restricted to the intended team and non-production sites. Do not use an identity allowed to modify deploys, environment variables, domains, or site configuration.

### Google Drive

Before import, open [Google Cloud OAuth clients](https://console.cloud.google.com/auth/clients/create) and create a **Web application** OAuth client. Enable **Use this client for an AI-powered agent**, add `https://api.domesystems.ai/oauth/callback` as an authorized redirect URI, and copy the client ID and secret. In **APIs & Services → Library**, enable both **Google Drive API** and **Google Drive MCP API** for that same project. Configure the consent screen as **Internal**, or add the test user if it is **External**.

- `google_oauth_client_id` and `google_oauth_client_secret`: enter values from a Google Cloud Web OAuth client configured as an AI-powered agent.

Enable the Drive and Drive MCP APIs, register the redirect URI shown by Dome, and request only `https://www.googleapis.com/auth/drive.readonly`.

## Import and verify

1. Import the template and provide the values above.
2. Complete every browser OAuth flow with the intended dedicated test user. Token-based sources do not open a browser.
3. Open **Tools**, refresh discovery, and confirm every connection is attached to the template gateway.
4. Run the managed agent against known test data. Treat the template as verified only when the run succeeds **and calls at least one expected read-only tool**.

If a connection is unreachable, check the provider section above for its callback, API/MCP enablement, token prefix, consent scopes, and user/workspace access before retrying.