Skip to main content
Use OAuth for Claude Desktop, Claude (web & mobile), ChatGPT (web) and Grok (web). Claude Desktop uses the same remote connector mechanism as Claude web; no local bridge or tunnel is required. SendPilot creates a workspace connection while Clerk handles sign-in, consent, token exchange and refresh.

​
1. Review your workspace and access

Open Integrations → MCP. If workspace access needs activation, follow the dashboard’s subscription options first. Existing subscribers use Manage Subscription for billing and cancellation. A checkout redirect alone does not prove payment; setup unlocks after the backend verifies access. On your first visit, choose your client from the visible app/developer list. On return visits, select the client beside your connection activity. Choose a remote OAuth client and check the workspace name.
  • Read and Write is preselected for new connections and when starting another connection.
  • Read Only remains available before creation.
  • Review the exact permissions in the panel. Current workspace permissions and plan restrictions still apply.
Click Create Connection. This creates a URL and stored permission selection; it does not authorize the assistant or count as first use. Selecting another client does not create a connection automatically.

​
2. Configure the assistant

Copy the connection’s MCP Server URL and Public Client ID from the setup panel.
Do not use the generic https://mcp.sendpilot.ai API-key endpoint for this OAuth flow. Keep the supplied URL exactly as stored; older /mcp/connections/... URLs remain valid and are not rewritten.

​
Claude

  1. In Claude web or Desktop, open Customize → Connectors → + → Add custom connector.
  2. Name it SendPilot and paste the MCP Server URL.
  3. Open Advanced settings for the connector. Older layouts may show Sign in now → Use your own OAuth client.
  4. Paste Public Client ID into OAuth Client ID. Leave the client secret empty.
  5. Add/connect the connector and continue to sign-in and consent.
Team/Enterprise owners first add the connector through Organization settings → Connectors → Add → Custom → Web; members then connect it through Customize. Remote connectors are brokered through the Claude account across clients. Current Claude instructions. Organization registration does not make one user’s SendPilot resource usable by every member: each connection still belongs to its SendPilot creator. Arrange separate creator-bound resources/connectors where your organization requires them.

​
ChatGPT

  1. Open Settings → Security and login and enable Developer mode.
  2. Open ChatGPT Plugins, select +, and create a developer-mode app with the MCP Server URL.
  3. Choose OAuth, supply the Public Client ID, and leave the client secret empty.
  4. Complete OAuth sign-in and consent. If the wizard shows Scan Tools, run the scan and wait for it before Create.
Workspace/admin interfaces can instead show Workspace settings → Apps → Create, or Settings → Apps → Create for authorized users. Some still enable developer mode under Apps → Advanced Settings. Use the current developer guide and workspace-admin guide for the layout and permissions applicable to your account. Use the supplied static public client ID. Automatic CIMD/DCR registration is not the setup for this workspace-bound connection. Existing apps may retain an older tool schema: refresh their tools after server updates, or recreate/republish the app when the workspace’s controls require it.

​
Grok

  1. Open Grok Connectors → New Connector → Custom.
  2. Name it SendPilot and enter the MCP Server URL supplied by your Grok connection.
  3. When OAuth Credentials Required appears, paste the Public Client ID into Client ID. Leave Client Secret blank and set Token Auth Method to none (PKCE only).
  4. Keep automatically discovered authorization/token endpoints. If asked for scopes, use openid profile email offline_access.
  5. Choose Save & Connect, allow the sign-in popup, and review consent with the SendPilot account that created the connection. Enable the connector’s tools and verify your workspace with a read-only prompt.
Grok Business/Enterprise admins first provision the custom server in console.x.ai → Grok Business → Connectors → Add Connector → Other. A shared team connector does not change SendPilot’s creator-bound authorization: each person needs their own SendPilot connection. Sources: Grok custom connectors and team connector management. SendPilot’s hosted endpoint is already public, so no tunnel is required. Use the Grok Client ID supplied by SendPilot, rather than a Claude/ChatGPT Client ID or an xAI API key. Client labels and availability depend on assistant version, plan, and organization policy. Do not choose no authentication or paste a SendPilot API key into an OAuth field.

​
3. Sign in and authorize

Sign in using the same SendPilot account that created the connection. The grant is fixed to its creator, workspace, registered client and resource URL; another member cannot borrow it merely because they belong to the same workspace. The SendPilot-branded consent page uses Clerk’s native authorization controls:
  • Desktop: workspace details/permissions and approval sit side by side.
  • Mobile: approval comes first; Workspace details & permissions is collapsed underneath and can be expanded before deciding.
Review the account, application, workspace permissions and destination, then choose Allow or Deny. Clerk remains the OAuth issuer even when the page uses SendPilot branding. Workspace permissions are granted only on authorization; openid establishes identity and does not itself grant workspace access.

​
4. Verify actual use

Return to setup and choose I’ve Finished Setup. Enable SendPilot in a chat and ask:
Show my SendPilot workspace and campaigns. Don’t change anything.
Use Check Recorded Use or Refresh Connection Records. These refresh historical records; they do not continuously ping the assistant or prove that every tool succeeds. Read and Write does not bypass outreach and credit-spend approvals. Read Only forbids those writes regardless of a prompt requesting them.

​
Refresh, recovery, and disconnection

The assistant obtains and refreshes tokens through Clerk. Tokens must remain valid for the configured issuer, registered client, creator, and exact connection URL as their sole resource audience. Refresh does not switch workspaces or recover a revoked grant. Resume Setup reuses the stored URL and permissions; it does not upgrade an existing Read Only connection. Create a new connection for a different workspace, client, or permission selection. Disconnect revokes the connection. It does not disconnect your LinkedIn sender, sign you out of SendPilot, or recall an already-started provider action. Reconnecting requires a new connection. During locked access, expand Manage existing access to inspect or revoke previous connections; history is hidden by default.

​
Troubleshooting

  • “This connection requires OAuth support”: use Retry OAuth Setup. Operators should verify that MCP_OAUTH_ENABLED is not explicitly false and that issuer/client configuration is valid. A new image preserves existing environment overrides.
  • Wrong account or workspace: sign in as the creator. Create another connection for another workspace rather than editing the URL.
  • 401: check the exact resource URL and client ID, then restart authorization. An API key is not an OAuth client secret.
  • invalid_scope naming email or profile: the registered Clerk application must allow openid profile email offline_access. Issuer discovery alone does not grant those scopes to every app. Start a fresh authorization after the allowlist is corrected; these identity scopes do not expand workspace permissions.
  • No recorded use: creation and sign-in alone are not a tool request. Run the workspace prompt, then refresh records.
  • Upgrade/payment required: the workspace owner manages the add-on. Restoring paid access re-enables unrevoked connections.
  • Consent stays on Clerk’s hosted domain: custom consent routing is a separate Clerk instance setting. Deploying the branded page or changing the backend issuer does not change that path by itself.
A valid active connection’s unauthenticated URL advertises WWW-Authenticate with its matching protected-resource metadata URL. An invented or revoked connection ID is not a valid discovery test.