Metabase
Connect Metabase to find and run saved questions, read dashboards, run SQL, build reports, and manage collections, alerts, people and permissions.
You paste two values into PopMCP: your Metabase address and an API key an admin creates in Metabase under Admin, Settings, Authentication, API keys.
- Setup time
- 2 min
- Auth
- API credentials
- API base URL
- https://YOUR-METABASE/api
- Rate limits
- Metabase publishes no request limit for its API: it is your own server, so what it can take depends on its size and your database. Sign-in attempts are throttled, which API keys are not part of.
Before you begin
- Metabase Cloud, or self-hosted Metabase version 0.49 or later, on any plan including the free open-source edition
- A Metabase address the internet can reach over HTTPS. A Metabase only on a private network or VPN cannot be connected
- An admin account in Metabase: only admins can create API keys
Get your credentials
Open Metabase Admin
Sign in to Metabase as an admin. Click the grid icon in the upper right and select Admin, then go to the Settings tab.
Open https://YOUR-METABASE/admin/settings (replace YOUR-METABASE with your Metabase metabase).
Find API keys
In the left menu, open Authentication and click API keys. On some older versions it is further down the Authentication page: scroll to API Keys and click Manage.
Open https://YOUR-METABASE/admin/settings/authentication/api-keys (replace YOUR-METABASE with your Metabase metabase).
API keys
Create API keys to let users authenticate API calls or make them programmatically.
Create the key
Click Create an API key. Under Key name type PopMCP. Under Group this key should belong to, choose Administrators if you want every tool, including people, settings and permissions. Any other group works too: the key can then reach only the questions, dashboards and data that group has access to. Click Create.
Open https://YOUR-METABASE/admin/settings/authentication/api-keys (replace YOUR-METABASE with your Metabase metabase).
API keys
Create API keys to let users authenticate API calls or make them programmatically.
Copy the key
Metabase shows the new key, which starts with mb_, and will not show it again. Copy the whole key. If you lose it, you can edit the key in the same list and regenerate it, which stops the old one.
Open https://YOUR-METABASE/admin/settings/authentication/api-keys (replace YOUR-METABASE with your Metabase metabase).
API keys
Create API keys to let users authenticate API calls or make them programmatically.
Store this key somewhere safe. For security reasons, we can't show it to you again.
Paste the values into PopMCP and connect
In PopMCP open Metabase. Under Metabase address paste the address you sign in at, like https://yourcompany.metabaseapp.com, or with its subdirectory if it has one. Paste the key under API key and click Connect Metabase. PopMCP checks that the address is a Metabase and that the key works, then names the connection after your site.
Connect in PopMCP
Open your workspace, choose Metabase in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Metabase addresstext | The address you sign in at. It needs to be on the internet with HTTPS. |
| API keysecret | Metabase shows it once, when you create it. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Metabase immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP checks that the address answers as Metabase, then that Metabase accepts the key, and marks the connection Verified under your site name, noting whether the key is in the Administrators group. Asking the AI for an overview of your Metabase returns its version, the databases the key can see and what is at the top of Our analytics.
Troubleshooting
"... does not answer like Metabase ..."
Why: The address is not your Metabase, or something other than Metabase answers there, such as a sign-in proxy.
Fix: Paste the address you sign in to Metabase at, without anything after it. If a proxy or single sign-on gateway sits in front of Metabase, it has to let `/api` through.
"Metabase at ... did not accept this API key ..."
Why: The key was cut off when copied, or it was deleted or regenerated.
Fix: Make a new key under Admin, Settings, Authentication, API keys and paste all of it, starting with `mb_`.
"... is a private address ..." or "We could not reach ..."
Why: Your Metabase is only on a private network or VPN, or is not on HTTPS.
Fix: PopMCP has to reach Metabase over the internet with HTTPS. Put Metabase behind a public HTTPS address, or use Metabase Cloud.
A tool answers 403
Why: The key's group does not have access to that thing, or the tool is for admins only.
Fix: In Metabase, give the group access under Admin, Permissions, or edit the key and pick the Administrators group.
A tool answers 402 or 404
Why: 402 means a paid Metabase feature. 404 means a wrong id, or a tool newer than your version of Metabase.
Fix: The AI can find the right id with search and read your version from the connection profile. Upgrading Metabase adds the newer tools.
SQL is refused on a read-only connection
Why: It is not a single statement that only reads, or it has a word like DELETE or UPDATE in it, sometimes as a column name.
Fix: Put a column with such a name in double quotes. To run other statements, turn on write actions for the connection in PopMCP.
A query times out or returns too much
Why: Queries run on your own database, and PopMCP waits about 100 seconds and reads up to 10 MB.
Fix: Ask for filters, aggregates or fewer columns. Metabase itself stops at 2,000 raw rows or 10,000 aggregated rows unless an admin changed that.
Reference
- Metabase API documentation
- Metabase credentials screen:
https://YOUR-METABASE/admin/settings/authentication(replace YOUR-METABASE with your Metabase metabase) - Connect an AI client
- Access modes and tool catalogs