Connect MCP: set up Claude, Claude Code, Cursor and other clients

These clients sign in via OAuth. You do not need an access key.

1. In Claude open Settings → Connectors → Add custom connector.
2. Enter <instance address>/api/mcp as the server URL.
3. Claude sends you to the login, then the Project Manager consent page opens.
4. Review the access (see next step) and click Allow. Deny cancels.
5. Test the connection by asking "Which organizations do I have access to?" – Claude calls list_organizations.

The consent page shows what the client may do and lets you narrow access under Settings. Behind the scenes it creates a revocable access key; the token itself is never shown to you.

Access to

By default the currently active organization with your role. The connection is then bound to that organization.

All organizations I belong to

Makes the connection account-wide. The organization is then given per request (header or organization argument). Without an active organization this option is fixed on.

Permissions: Read only

Allows tools with scope read (read and list data).

Permissions: Read and write

Additionally tools with scope write (create and edit entries).

Permissions: Read, write and delete

Full access, additionally tools with scope delete. Preselected when the client does not request a narrower scope.

Use an API key instead

Alternative for clients without a browser session: enter an existing access key (mk_…) and authorize with it.

These clients read a bearer token from a configuration file. Create an MCP access key in your account under Integrations (the full key is shown only once) and add it to the MCP configuration.

type

http

url

<instance address>/api/mcp

headers → Authorization

Bearer <YOUR_KEY> – the key starts with mk_.

headers → X-Organization-Slug (account-wide only)

Slug of the organization the key should address.

1. Open Account → Integrations and create a key for MCP/AI tools; set a name, the access level and the account-wide choice.
2. Copy the key immediately – it cannot be shown again.
3. Add server address and headers to your client's MCP configuration (the setup guide /mcp/setup shows a complete JSON example with mcpServers → project-manager).
4. Restart the client and test with a read request.

A connection is either bound to one organization or account-wide. For account-wide connections you choose the organization in one of these ways.

Organization-bound

The connection applies only to the organization that was active when it was created. It works only while that organization is your active organization in the web app.

Account-wide + header

X-Organization-Id, X-Organization-Slug or X-Organization-Name set the organization (evaluated in this order). Role and modules are derived from your membership in that organization.

Account-wide without header

All tools are listed and gain an additional organization parameter (name, slug or ID). Without it an error is returned; list_organizations works without an organization.

Not a member

If you name an organization you are not a member of, the server rejects the request.

All connections – including those created via the consent page (named "Claude — connected <date>") – appear in your account under Integrations with name, prefix, permissions and last use. MCP keys and WebDAV keys are separate kinds and not interchangeable.

1. Open Account → Integrations and select the key section for MCP/AI tools.
2. Identify the connection by name and last use.
3. Revoke it. From then on requests with that key and all OAuth tokens issued through it are rejected.
4. Create a new connection with narrower permissions if needed.

If you build your own client, the metadata is available at the standard paths. The flow is OAuth 2.0 authorization code with PKCE (S256 only); clients register dynamically (RFC 7591).

/.well-known/oauth-authorization-server

Authorization server metadata: authorization, token and registration endpoints; supports response_type code, grants authorization_code and refresh_token, PKCE S256 and token endpoint authentication none.

/.well-known/oauth-protected-resource

Metadata of the protected resource (<instance address>/api/mcp) and a pointer to the authorization server. A 401 from the MCP endpoint points to it via WWW-Authenticate.

/api/mcp/oauth/register

Dynamic client registration; issues a client_id (dyn_…). At least one redirect_uri must be allowed.

/api/mcp/oauth/authorize and /token

Authorization and token issuance. The authorization code is valid for 5 minutes, the access token for 1 hour, the refresh token for 365 days and is reissued on every refresh.

Allowed redirect URIs

Loopback addresses (localhost, 127.0.0.1, ::1) on any port and addresses the operator of the instance explicitly allowed. Other addresses are rejected.

Direct keys

Alternatively /api/mcp accepts any MCP key with prefix mk_ as bearer token.