> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendpilot.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth connections

> Connect Claude and ChatGPT with workspace-bound OAuth, review consent, verify use, and manage access.

Use OAuth for **Claude (web & mobile)** and **ChatGPT (web)**. SendPilot creates a connection for your selected workspace; Clerk handles sign-in, consent, authorization-code exchange, and token refresh. No workspace API key or OAuth client secret is required for this flow.

## 1. Review your workspace and access

Open **Integrations → MCP**. If workspace access needs activation, follow the dashboard's subscription options first. Existing subscribers use **Manage Subscription** for billing and cancellation. A checkout redirect alone does not prove payment; setup unlocks after the backend verifies access.

On your first visit, choose your client from the visible app/developer list. On return visits, select the client beside your connection activity. Choose **Claude (web & mobile)** or **ChatGPT (web)** and check the workspace name.

* **Read and Write** is preselected for new connections and when starting another connection.
* **Read Only** remains available before creation.
* Review the exact permissions in the panel. Current workspace permissions and plan restrictions still apply.

| Choice | Connection permission set |
| - | - |
| Read Only | `workspace:read`, `campaigns:read`, `leads:read`, `inbox:read`, `senders:read`, `credits:read` |
| Read and Write | All read scopes, plus `campaigns:write`, `leads:write`, `inbox:send`, `lead_sourcing:run` |

Click **Create Connection**. This creates a URL and stored permission selection; it does **not** authorize the assistant or count as first use. Selecting another client does not create a connection automatically.

## 2. Configure the assistant

Copy the connection's **MCP Server URL** and **Public Client ID** from the setup panel.

```text theme={null}
MCP Server URL: https://mcp.sendpilot.ai/connections/YOUR_CONNECTION_ID
Public Client ID: the value shown for your selected assistant
Client secret: leave empty
```

Do not use the generic `https://mcp.sendpilot.ai` API-key endpoint for this OAuth flow. Keep the supplied URL exactly as stored; older `/mcp/connections/...` URLs remain valid and are not rewritten.

### Claude

1. On Claude's website, open **Settings → Connectors → Add custom connector**.
2. Name it SendPilot and paste the **MCP Server URL**.
3. Choose **Sign in now → Use your own OAuth client** where shown.
4. Paste **Public Client ID** into **OAuth Client ID**. Leave the client secret empty.
5. Add/connect the connector and continue to sign-in and consent.

### ChatGPT

1. Open **Settings → Apps → Advanced settings** and enable developer mode where available.
2. Create a custom MCP app and paste the **MCP Server URL**.
3. Choose **OAuth**, supply the **Public Client ID**, and leave the client secret empty.
4. Connect the app and continue to sign-in and consent.

Client labels and availability depend on assistant version, plan, and organization policy. Do not choose no authentication or paste a SendPilot API key into an OAuth field.

## 3. Sign in and authorize

Sign in using the **same SendPilot account that created the connection**. The grant is fixed to its creator, workspace, registered client and resource URL; another member cannot borrow it merely because they belong to the same workspace.

The SendPilot-branded consent page uses Clerk's native authorization controls:

* **Desktop:** workspace details/permissions and approval sit side by side.
* **Mobile:** approval comes first; **Workspace details & permissions** is collapsed underneath and can be expanded before deciding.

Review the account, application, workspace permissions and destination, then choose **Allow** or **Deny**. Clerk remains the OAuth issuer even when the page uses SendPilot branding. Workspace permissions are granted only on authorization; `openid` establishes identity and does not itself grant workspace access.

## 4. Verify actual use

Return to setup and choose **I’ve Finished Setup**. Enable SendPilot in a chat and ask:

> Show my SendPilot workspace and campaigns. Don't change anything.

Use **Check Recorded Use** or **Refresh Connection Records**. These refresh historical records; they do not continuously ping the assistant or prove that every tool succeeds.

| State | Meaning |
| - | - |
| Awaiting first use | No authenticated use has been recorded yet |
| Use recorded | The server has recorded use; check the timestamp |
| Access suspended | Current workspace billing/access prevents MCP use |
| Access not verified | Current access could not be verified |
| Revoked | The resource no longer authorizes access |

Read and Write does not bypass [outreach and credit-spend approvals](/ai/mcp#approvals-and-writes). Read Only forbids those writes regardless of a prompt requesting them.

## Refresh, recovery, and disconnection

The assistant obtains and refreshes tokens through Clerk. Tokens must remain valid for the configured issuer, registered client, creator, and exact connection URL as their sole resource audience. Refresh does not switch workspaces or recover a revoked grant.

**Resume Setup** reuses the stored URL and permissions; it does not upgrade an existing Read Only connection. Create a new connection for a different workspace, client, or permission selection.

**Disconnect** revokes the connection. It does not disconnect your LinkedIn sender, sign you out of SendPilot, or recall an already-started provider action. Reconnecting requires a new connection. During locked access, expand **Manage existing access** to inspect or revoke previous connections; history is hidden by default.

## Troubleshooting

* **“This connection requires OAuth support”:** use **Retry OAuth Setup**. Operators should verify that `MCP_OAUTH_ENABLED` is not explicitly `false` and that issuer/client configuration is valid. A new image preserves existing environment overrides.
* **Wrong account or workspace:** sign in as the creator. Create another connection for another workspace rather than editing the URL.
* **401:** check the exact resource URL and client ID, then restart authorization. An API key is not an OAuth client secret.
* **No recorded use:** creation and sign-in alone are not a tool request. Run the workspace prompt, then refresh records.
* **Upgrade/payment required:** the workspace owner manages the add-on. Restoring paid access re-enables unrevoked connections.
* **Consent stays on Clerk's hosted domain:** custom consent routing is a separate Clerk instance setting. Deploying the branded page or changing the backend issuer does not change that path by itself.

A valid active connection's unauthenticated URL advertises `WWW-Authenticate` with its matching protected-resource metadata URL. An invented or revoked connection ID is not a valid discovery test.