> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendler.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth connections

> Connect Claude, ChatGPT and Grok with workspace-bound OAuth, review consent, verify use, and manage access.

Use OAuth for **Claude Desktop**, **Claude (web & mobile)**, **ChatGPT (web)** and **Grok (web)**. Claude Desktop uses the same remote connector mechanism as Claude web; no local bridge or tunnel is required. SendPilot creates a workspace connection while Clerk handles sign-in, consent, token exchange and refresh.

## 1. Review your workspace and access

Open **Integrations → MCP**. If workspace access needs activation, follow the dashboard's subscription options first. Existing subscribers use **Manage Subscription** for billing and cancellation. A checkout redirect alone does not prove payment; setup unlocks after the backend verifies access.

On your first visit, choose your client from the visible app/developer list. On return visits, select the client beside your connection activity. Choose a remote OAuth client and check the workspace name.

* **Read and Write** is preselected for new connections and when starting another connection.
* **Read Only** remains available before creation.
* Review the exact permissions in the panel. Current workspace permissions and plan restrictions still apply.

| Choice | Connection permission set |
| - | - |
| Read Only | `workspace:read`, `campaigns:read`, `leads:read`, `inbox:read`, `senders:read`, `credits:read` |
| Read and Write | All read scopes, plus `campaigns:write`, `leads:write`, `inbox:send`, `lead_sourcing:run` |

Click **Create Connection**. This creates a URL and stored permission selection; it does **not** authorize the assistant or count as first use. Selecting another client does not create a connection automatically.

## 2. Configure the assistant

Copy the connection's **MCP Server URL** and **Public Client ID** from the setup panel.

```text theme={null}
MCP Server URL: https://mcp.sendpilot.ai/connections/YOUR_CONNECTION_ID
Public Client ID: the value shown for your selected assistant
Client secret: leave empty
```

Do not use the generic `https://mcp.sendpilot.ai` API-key endpoint for this OAuth flow. Keep the supplied URL exactly as stored; older `/mcp/connections/...` URLs remain valid and are not rewritten.

### Claude

1. In Claude web or Desktop, open **Customize → Connectors → + → Add custom connector**.
2. Name it SendPilot and paste the **MCP Server URL**.
3. Open **Advanced settings** for the connector. Older layouts may show **Sign in now → Use your own OAuth client**.
4. Paste **Public Client ID** into **OAuth Client ID**. Leave the client secret empty.
5. Add/connect the connector and continue to sign-in and consent.

Team/Enterprise owners first add the connector through **Organization settings → Connectors → Add → Custom → Web**; members then connect it through Customize. Remote connectors are brokered through the Claude account across clients. [Current Claude instructions](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp).

Organization registration does not make one user's SendPilot resource usable by every member: each connection still belongs to its SendPilot creator. Arrange separate creator-bound resources/connectors where your organization requires them.

### ChatGPT

1. Open **Settings → Security and login** and enable **Developer mode**.
2. Open [ChatGPT Plugins](https://chatgpt.com/plugins), select **+**, and create a developer-mode app with the **MCP Server URL**.
3. Choose **OAuth**, supply the **Public Client ID**, and leave the client secret empty.
4. Complete OAuth sign-in and consent. If the wizard shows **Scan Tools**, run the scan and wait for it before **Create**.

Workspace/admin interfaces can instead show **Workspace settings → Apps → Create**, or **Settings → Apps → Create** for authorized users. Some still enable developer mode under **Apps → Advanced Settings**. Use the [current developer guide](https://developers.openai.com/api/docs/guides/developer-mode) and [workspace-admin guide](https://help.openai.com/en/articles/12584461-developer-mode-and-mcp-apps-in-chatgpt-beta) for the layout and permissions applicable to your account.

Use the supplied static public client ID. Automatic CIMD/DCR registration is not the setup for this workspace-bound connection. Existing apps may retain an older tool schema: refresh their tools after server updates, or recreate/republish the app when the workspace's controls require it.

### Grok

1. Open [Grok Connectors](https://grok.com/connectors) → **New Connector → Custom**.
2. Name it SendPilot and enter the **MCP Server URL** supplied by your Grok connection.
3. When **OAuth Credentials Required** appears, paste the **Public Client ID** into **Client ID**. Leave **Client Secret** blank and set **Token Auth Method** to **none (PKCE only)**.
4. Keep automatically discovered authorization/token endpoints. If asked for scopes, use `openid profile email offline_access`.
5. Choose **Save & Connect**, allow the sign-in popup, and review consent with the SendPilot account that created the connection. Enable the connector's tools and verify your workspace with a read-only prompt.

Grok Business/Enterprise admins first provision the custom server in **console.x.ai → Grok Business → Connectors → Add Connector → Other**. A shared team connector does not change SendPilot's creator-bound authorization: each person needs their own SendPilot connection.

Sources: [Grok custom connectors](https://docs.x.ai/grok/connectors) and [team connector management](https://docs.x.ai/grok/connector-management). SendPilot's hosted endpoint is already public, so no tunnel is required. Use the Grok Client ID supplied by SendPilot, rather than a Claude/ChatGPT Client ID or an xAI API key.

Client labels and availability depend on assistant version, plan, and organization policy. Do not choose no authentication or paste a SendPilot API key into an OAuth field.

## 3. Sign in and authorize

Sign in using the **same SendPilot account that created the connection**. The grant is fixed to its creator, workspace, registered client and resource URL; another member cannot borrow it merely because they belong to the same workspace.

The SendPilot-branded consent page uses Clerk's native authorization controls:

* **Desktop:** workspace details/permissions and approval sit side by side.
* **Mobile:** approval comes first; **Workspace details & permissions** is collapsed underneath and can be expanded before deciding.

Review the account, application, workspace permissions and destination, then choose **Allow** or **Deny**. Clerk remains the OAuth issuer even when the page uses SendPilot branding. Workspace permissions are granted only on authorization; `openid` establishes identity and does not itself grant workspace access.

## 4. Verify actual use

Return to setup and choose **I’ve Finished Setup**. Enable SendPilot in a chat and ask:

> Show my SendPilot workspace and campaigns. Don't change anything.

Use **Check Recorded Use** or **Refresh Connection Records**. These refresh historical records; they do not continuously ping the assistant or prove that every tool succeeds.

| State | Meaning |
| - | - |
| Awaiting first use | No authenticated use has been recorded yet |
| Use recorded | The server has recorded use; check the timestamp |
| Access suspended | Current workspace billing/access prevents MCP use |
| Access not verified | Current access could not be verified |
| Revoked | The resource no longer authorizes access |

Read and Write does not bypass [outreach and credit-spend approvals](https://docs.sendler.ai/ai/mcp.md#approvals-and-writes). Read Only forbids those writes regardless of a prompt requesting them.

## Refresh, recovery, and disconnection

The assistant obtains and refreshes tokens through Clerk. Tokens must remain valid for the configured issuer, registered client, creator, and exact connection URL as their sole resource audience. Refresh does not switch workspaces or recover a revoked grant.

**Resume Setup** reuses the stored URL and permissions; it does not upgrade an existing Read Only connection. Create a new connection for a different workspace, client, or permission selection.

**Disconnect** revokes the connection. It does not disconnect your LinkedIn sender, sign you out of SendPilot, or recall an already-started provider action. Reconnecting requires a new connection. During locked access, expand **Manage existing access** to inspect or revoke previous connections; history is hidden by default.

## Troubleshooting

* **“This connection requires OAuth support”:** use **Retry OAuth Setup**. Operators should verify that `MCP_OAUTH_ENABLED` is not explicitly `false` and that issuer/client configuration is valid. A new image preserves existing environment overrides.
* **Wrong account or workspace:** sign in as the creator. Create another connection for another workspace rather than editing the URL.
* **401:** check the exact resource URL and client ID, then restart authorization. An API key is not an OAuth client secret.
* **`invalid_scope` naming `email` or `profile`:** the registered Clerk application must allow `openid profile email offline_access`. Issuer discovery alone does not grant those scopes to every app. Start a fresh authorization after the allowlist is corrected; these identity scopes do not expand workspace permissions.
* **No recorded use:** creation and sign-in alone are not a tool request. Run the workspace prompt, then refresh records.
* **Upgrade/payment required:** the workspace owner manages the add-on. Restoring paid access re-enables unrevoked connections.
* **Consent stays on Clerk's hosted domain:** custom consent routing is a separate Clerk instance setting. Deploying the branded page or changing the backend issuer does not change that path by itself.

A valid active connection's unauthenticated URL advertises `WWW-Authenticate` with its matching protected-resource metadata URL. An invented or revoked connection ID is not a valid discovery test.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.