---
title: Grok bots
description: Two ways to give a Grok bot built on the xAI API access to Empiraa Signal and Empiraa GPS.
product: all
section: use-cases
order: 3
---

# Grok bots

A Grok bot built on the xAI API can work with Signal and GPS in two ways. Start with the REST API: it's the simpler route for a bot that runs on your server.

| | REST API with function calling | MCP connector |
|---|---|---|
| **Good for** | A bot that runs unattended and does a few set jobs | A bot that acts for one signed-in person and needs the full tool set |
| **Sign-in** | A Signal or GPS API key, kept on your server | An OAuth access token your app gets and refreshes |
| **Acts as** | The workspace or organization that owns the key | The person who signed in |
| **Setup** | Define the functions you want Grok to call | Run the OAuth flow yourself, then pass the token to xAI |

## Route 1: REST API with function calling

You describe one or more functions to Grok. When Grok decides to call one, your code makes the Signal or GPS request and hands the answer back.

```js
const tools = [{
  type: "function",
  function: {
    name: "list_deals",
    description: "List Deals in Empiraa Signal, newest first.",
    parameters: {
      type: "object",
      properties: { limit: { type: "integer", minimum: 1, maximum: 100 } },
    },
  },
}];

// Your handler, run when Grok calls list_deals
async function listDeals({ limit = 20 }) {
  const res = await fetch(`https://crm.empiraa.app/api/v1/deals?limit=${limit}`, {
    headers: { Authorization: `Bearer ${process.env.SIGNAL_API_KEY}` },
  });
  return res.json();
}
```

Give the key only the scopes the bot needs, for example `deals:read`. See [Signal authentication](../signal/api/authentication.md) and [GPS authentication](../gps/api/authentication.md).

## Route 2: the MCP connector

The xAI API can call a remote MCP server as a tool. It sends the token you give it in the `Authorization` header. It doesn't run the sign-in for you, so your app does that part.

1. Run the OAuth flow described in [How it works](../signal/mcp/how-it-works.md): discover the endpoints from the connector URL, register your client, send the person to sign in, and swap the code for tokens.
2. Keep the refresh token on your server. Access tokens last 1 hour.
3. Pass the current access token to xAI with each request:

   ```json
   {
     "type": "mcp",
     "server_url": "https://crm.empiraa.app/mcp",
     "server_label": "signal",
     "authorization": "ACCESS_TOKEN",
     "allowed_tools": ["get_my_focus", "get_hot_prospects", "list_deals"]
   }
   ```

Use `allowed_tools` to give the bot only the tools its job needs. Without it, every tool the connection can use goes into the model's context.

For GPS, use `https://plan.empiraa.app/mcp` and see [GPS: how it works](../gps/mcp/how-it-works.md).

## Keep it safe

- Start with **View only**, or read-only API scopes. Add write access once the bot's answers are right.
- A bot that makes changes through the connector still goes through preview and apply, and each change is recorded against the person who signed in.
- Signal pauses an app that makes an unusual number of changes or errors.