> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/balkanid-mcp/installation-and-setup/windsurf.md).

# Windsurf

Connect [Windsurf](https://docs.windsurf.com/windsurf/cascade/mcp) **Cascade** to BalkanID MCP.

**OAuth is preferred.** API keys remain available for Read-only or static-token setups.

### One-click (OAuth — recommended)

1. Open <https://mcp.balkanid.app>, sign in, and confirm the correct **tenant**.
2. In **OAuth Connectors**, choose **Windsurf**.
3. Click **Copy MCP config**. The clipboard contains a `mcpServers` snippet for `balkanid` with `serverUrl` set to the BalkanID MCP URL (no Bearer header — OAuth runs when you first use the server).
4. In Windsurf, open **Cascade** and click the **hammer** icon in the MCP toolbar, then **Configure**. This opens your Windsurf MCP config file.
5. Merge the snippet into the existing JSON and save. Click **Refresh** in the MCP toolbar so Windsurf reloads server definitions.
6. In Cascade, ask the agent to use a BalkanID tool. On the first BalkanID tool call, Windsurf opens your browser — sign in to BalkanID, select your **tenant**, and grant consent.

{% hint style="info" %}
OAuth currently requires **both Read and Write** scopes. See Authentication and Permissions.
{% endhint %}

### Manual configuration (OAuth fallback)

Open [Windsurf MCP configuration](https://docs.windsurf.com/windsurf/cascade/mcp) — typically via Cascade → hammer icon → **Configure**, or by editing the config file directly — and add:

```json
{
  "mcpServers": {
    "balkanid": {
      "serverUrl": "https://mcp.balkanid.app/server/mcp"
    }
  }
}
```

Save and click **Refresh** in the Cascade MCP toolbar. Trigger a BalkanID tool from Cascade and complete OAuth in the browser when prompted.

### One-click (API key)

1. In the [MCP UI](https://mcp.balkanid.app), create a key under **Bearer Auth Keys**.
2. Open **Connect** for that key, choose **Windsurf**, then copy the MCP config (includes the Bearer header).
3. Merge into your Windsurf MCP config as in the OAuth steps above, save, and click **Refresh** in Cascade.

### Manual configuration (API key fallback)

```json
{
  "mcpServers": {
    "balkanid": {
      "serverUrl": "https://mcp.balkanid.app/server/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}
```

Replace `YOUR_TOKEN_HERE` with the token from the MCP UI. Use a Read-only key when you only need discovery tools.

### Verify

Ask Cascade: “Call whoami on BalkanID MCP.” You should see your email and tenant ID.

### Disable or remove

Remove the `balkanid` entry from your Windsurf MCP config file and save, then click **Refresh** in the Cascade MCP toolbar so Windsurf drops the server. There is no separate disable toggle — deleting the entry is the only way to stop Cascade from loading it.

### Official documentation

Windsurf documentation for MCP servers:

* [Model Context Protocol](https://docs.windsurf.com/windsurf/cascade/mcp) — Windsurf Docs


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.balkan.id/balkanid-mcp/installation-and-setup/windsurf.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.