---
title: claude.ai and ChatGPT connectors
description: Connect web AI apps such as claude.ai and ChatGPT to your panel with OAuth 2.1: sign in as admin, choose scopes and duration, and revoke the connection when you want.
url: https://nexcmp.com/docs/configure-with-ai/oauth-connectors/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# claude.ai and ChatGPT connectors

> **Where in the admin:** System › Settings › API & AI agents (`/agent/keys`), tab **Connected apps**. The consent screen opens at `/agent/consent` when a connector asks for access (it is not in the menu).

## What it does

Web AI apps cannot read a key from your disk. They connect with **OAuth**: you add the panel's MCP URL, the app sends you to your own admin to sign in, you choose what the app may do and for how long, and the app receives short-lived tokens. No key is copied or pasted. You can cut the app off at any time.

Use this for claude.ai custom connectors, ChatGPT developer-mode connectors and any other MCP client that supports OAuth with dynamic client registration. Command-line tools can use the same flow, but an [admin API key](https://nexcmp.com/docs/configure-with-ai/admin-api-keys/) is simpler for them.

## Requirements

| Item | Requirement |
|---|---|
| URL | `https://cloud.example.com/mcp/admin`, reachable from the internet (the vendor's servers connect to it). |
| Reverse proxy | If you put your own proxy in front of the panel, it must forward `/mcp/admin`, `/oauth-admin/` and the `/.well-known/` paths to the panel. |
| You | Signed in to the NexCMP admin **in the same browser** you use for the consent screen. |
| Client | Supports MCP over Streamable HTTP, OAuth 2.1 with PKCE (S256) and dynamic client registration. |

## Connect

1. In the AI app, add a custom MCP connector and paste `https://cloud.example.com/mcp/admin`. In claude.ai this is under the connectors settings (add custom connector); in ChatGPT it is under developer mode (add an MCP connector, authentication OAuth).
2. Choose **Sign in** (or "Connect") in the app. Your browser opens the NexCMP admin consent screen. If you are not signed in, sign in first; the screen continues afterwards.
3. Read the card: "**Example AI app** wants to manage this NexCMP admin" (the name of the app that is asking), with the address you will be sent back to.
4. Tick the scopes to grant. The ones the app asked for are pre-ticked; if it asked for none, only `admin:read` is ticked. See [Scopes](https://nexcmp.com/docs/configure-with-ai/admin-api-keys/#scopes).
5. Choose how long the connection lasts: **7**, **30** or **90** days (default 30).
6. Click **Allow**. The browser returns to the app, which is now connected. Click **Deny** to refuse.

![Consent screen asking to allow an AI app, with scope checkboxes, a duration choice and Allow and Deny buttons](https://nexcmp.com/docs/images/configure-with-ai/oauth-connectors-01-consent.webp)

::: important Choose scopes like you would for a key
Grant the smallest set that does the job. Money, delete and security actions still stop at a preview and need your approval, but a connection with `settings:write` can still change your branding and email.
:::

## Manage and revoke

Open **System › Settings › API & AI agents › Connected apps**. The table lists every app you connected: application, scopes, when it connected, when it expires and when it was last used.

To cut an app off, click **Revoke** and confirm. Its tokens stop working immediately; the app has to go through the consent screen again to reconnect.

![Connected apps tab listing one AI app with its scopes, expiry and a Revoke button](https://nexcmp.com/docs/images/configure-with-ai/oauth-connectors-02-connected-apps.webp)

## How the flow works

| Step | Detail |
|---|---|
| Discovery | The app reads `/.well-known/oauth-protected-resource/mcp/admin` and then `/.well-known/oauth-authorization-server/oauth-admin`. The issuer is `https://cloud.example.com/oauth-admin`. |
| Registration | The app registers itself (`POST /oauth-admin/register`, RFC 7591). Only public clients are supported (no client secret). The redirect address must be `https`, or `http` on the same computer (loopback). |
| Authorization | `GET /oauth-admin/authorize` with PKCE method `S256`. A `resource` parameter, when sent, must be this panel's `/mcp/admin` URL. The request is valid for 10 minutes and is tied to the browser that started it. |
| Consent | You choose scopes and duration (above). The authorization code is valid 60 seconds and works once. |
| Tokens | `POST /oauth-admin/token` returns an **access token** (an `ak_o...` key, valid 1 hour or until the connection ends, whichever is sooner) and a **refresh token** (`akr_...`). Every refresh returns a new refresh token; the old one stops working. The connection ends after the days you chose. |
| Revocation | **Revoke** in Connected apps, or the app calls `POST /oauth-admin/revoke` (RFC 7009). |

The access token behaves like an admin key with the scopes you granted: same scope rules, confirmation, rate limit and activity log. Its calls show up on the **Activity** tab.

## Verify

1. In the app, ask "run system_health" (or "what tools do you have?"). The app lists the tools your scopes allow ([the tool list](https://nexcmp.com/docs/configure-with-ai/mcp-admin/#tools)).
2. Open **Connected apps**: **Last used** moves.
3. Open **Activity**: the calls are listed with the app's name and `mcp`.

## Limits & notes

- If the app asks again to sign in after an hour, that is normal when a client does not refresh; reconnect.
- A refresh token that is used twice is treated as stolen: the whole connection is revoked. Reconnect from the app.
- An authorization code used twice is rejected (`invalid_grant`) and the tokens already issued from it are revoked.
- OAuth access never gives more than the scope rules allow: [what a key can never do](https://nexcmp.com/docs/configure-with-ai/admin-api-keys/#what-a-key-can-never-do) applies to connected apps too.
- Vendors change their menus and what they support. If a vendor's app does not offer custom connectors on your plan, use an [admin API key](https://nexcmp.com/docs/configure-with-ai/admin-api-keys/) with a desktop or command-line client instead.

## Troubleshooting

| Symptom | Cause | Fix |
|---|---|---|
| Consent screen says "Wrong browser" | The request was started in another browser than the one you are signed in to | Start the connection again from the AI app in the same browser. |
| Consent screen says the request expired or is missing | More than 10 minutes passed, or the link was opened twice | Start the connection again from the AI app. |
| "Unknown client" or "redirect address does not match" page | The app registration is stale, or it uses a redirect address it did not register | Remove the connector in the app and add it again. |
| `invalid_target` | The `resource` sent is not this panel's `/mcp/admin` URL | Use the exact URL shown on the **Connect an AI** tab. |
| `invalid_request` about PKCE | The client does not send `code_challenge_method=S256` | Use a client that supports OAuth 2.1 with PKCE. |
| The app connects but a call returns `insufficient_scope` | You did not tick that scope | Revoke the connection and connect again with the scope ticked. |
| The app cannot reach the URL | DNS, TLS or the reverse proxy blocks `/mcp/admin`, `/oauth-admin/` or `/.well-known/` | Check the proxy rules. |