When you connect an AI app, Zorlya’s Connect page shows who is asking, lets you pick the account and a permission level, and asks you to sign in. Read only is the default. You can end any connection later under Settings, Integrations.
What happens when you connect
- You add the address. The address is
https://mcp.zorlya.comfor every app. There is no API key. - Your browser opens the Connect page on
api.zorlya.com. It has two columns. The left column says who is asking: the AI app and the company that makes it. The right column says what it could do, with the real tools listed. Only AI apps on Zorlya’s list can connect. A program that is not on the list gets an error page and nothing is sent to it. - You choose the account. The page lists each kind of Zorlya account you can use: job seeker, hiring, support or staff. If you belong to more than one company, you also choose the company. The AI app acts as that account only.
- You choose the permission level. See the next section. Read only is already selected. Under Advanced: choose areas you can also switch off whole areas, such as notes, for this one connection. The tool list on the page follows your choices.
- You continue to sign in, or cancel. Cancel tells the AI app that you declined and shares nothing. Continue opens the sign in step.
- You sign in to that account. The sign-in page for the account’s app opens with a note that says which AI app, account, company and permissions you are approving. Sign in with your password or a passkey. Google and GitHub also work for Read only. If you are already signed in, the page offers “Continue as” and your click counts as the sign-in for read only access. For any level that changes data, Zorlya asks for your password or a passkey again, even when you are signed in.
- You get an email. It names the AI app, the account, the permission level and the time, and has a link to disconnect.
- Your browser goes back to the AI app, which is now connected.
Connecting a job seeker account needs the Pro plan, because AI client access is part of Pro (the pricing page lists it). On Free or Plus, Zorlya says so after you sign in and connects nothing. You can change your plan and connect again. Hiring, support and staff accounts do not depend on a job seeker plan.
The Connect page waits 10 minutes and works once. If it says the request expired, start again from the AI app. Use one browser for the whole flow and allow cookies, because the page is tied to the browser that started it.
Permission levels
| Level | What the AI app can do |
|---|---|
| Read only | Read what the account can read. It cannot change anything. This is the default. |
| Read and change | Read, and make the changes the tools allow, such as saving a job, adding a note or moving a candidate. Zorlya asks for your password or a passkey again. |
| Read, change and delete | Shown only for an account whose tools include a delete. No tool deletes anything today, so you will not see this level yet. |
The level can only lower what the AI app asked for. To raise it later, connect again.
Five more limits apply at the same time, and the AI app gets what all of them allow:
- The areas you switched off on the Connect page, or later with Lower access in your connections. An area you switched off stays off until you connect again.
- An administrator can switch an area or an action off for everyone, and deletes start switched off.
- The list of AI apps sets a ceiling for each app.
- Your account’s own rights are checked on every call. If you leave a company or lose a staff role, the AI app loses that access at once.
- Each kind of call has its own limit per minute: 120 reads, 30 changes and 5 deletes.
What each account gets
The AI app sees only the tools of the account you chose.
| Account | Tools | What they cover |
|---|---|---|
| Job seeker | 20 | Search jobs, your matches, profile and resume; read your applications, saved jobs, notifications and documents. With change: save jobs, track an application, add a note, mark notifications read. |
| Hiring | 11 | One company’s roles and candidates, team and plan usage. With change: move a candidate to another stage (the candidate is emailed), add a note, submit your own scorecard. Your role in the company decides which of them work. |
| Support | 7 | Tickets, customers and internal notes. With change: draft a reply, move a ticket to open or on hold, and add an internal note. |
| Staff | 17 | Read only: settings, ingest health, the audit log, billing summary, the moderation queue, account counts, sources and their runs, and other counts and short lists. Each depends on your staff role. |
No tool deletes data, and staff have no tool that changes anything.
An AI app cannot email a customer. A reply it writes is saved as a draft on the ticket, shown in the support app’s reply box with a badge, and only the agent can send it. A status it suggests shows as an Apply button. Over MCP a ticket can be moved only to open or on hold. A draft is kept for 7 days if nobody sends it.
What is logged
Zorlya records the requests an AI app makes for you, with their contents: which tool, the arguments, when, the result status and size, and the address and browser name the request came from. Tokens, authorization codes and the passwords of the sign-in step are never recorded, but the arguments of a tool call are stored as the app sent them, so do not type a secret into a chat with a connected app. The company that runs the AI app also receives what the app reads, under its own privacy policy. You and Zorlya’s super administrators can view the log. The privacy policy says what is kept and for how long.
End a connection
- Job seekers can disconnect an AI app under Settings, Integrations, AI clients.
- The email you got when you connected has a Disconnect link to
mcp.zorlya.com/connections, which lists your connections for every kind of account, lets you lower one and ends it. - In the AI app, remove the connector. In Claude Code, run
/mcpand choose Clear authentication.
Access tokens last one hour and refresh tokens 30 days. Ending a connection stops both at once.