GoLocomotiveSet up your AI client
Connect Claude Code with a token, or a connector such as claude.ai or ChatGPT through your app's own sign in page.
Your app's MCP server lives at one address: your app's address followed by /mcp. On this page, https://orders.example.com stands for your app's address.
There are two ways in. A coding assistant or a script uses a token. A connector in a chat app (claude.ai, the Claude desktop app, ChatGPT) uses your app's sign in page, the standard OAuth flow.
Claude Code, with a token#
- Get a token by signing in to the app's API with your email and password. A developer on your team can do it with one request:
curl -s https://orders.example.com/api/collections/users/auth-with-password \
-H 'content-type: application/json' \
-d '{"identity":"you@example.com","password":"your password"}'
The answer holds "token": "…".
- Add the server to Claude Code:
claude mcp add --transport http orders https://orders.example.com/mcp \
--header "Authorization: Bearer <token>"
- Ask Claude Code what it can do in
orders. It lists your app's tools.
The token is your session: it lasts as long as a session of your app (12 hours unless your app sets another length), and a password change ends it. Treat it like a password.
A connector, through your app's sign in#
For claude.ai, the Claude desktop app, ChatGPT and other clients that support remote MCP servers with OAuth:
- In the client, add a custom connector (the name of the menu differs per client) with the address
https://orders.example.com/mcp. - The client opens your app's own sign in page in a window. Sign in with your app account, as on the app.
- The page asks: "Allow <the client> to act as <your email>?". Accept.
- The client receives a key valid one hour, renewed by itself for up to 30 days of use. You never copy a token.
A password change or an email change ends every connection at once: the client must sign in again.
Other clients#
Any client that speaks MCP over HTTP can connect: with OAuth when it supports it, else with a bearer token in the Authorization header as for Claude Code. Your app speaks the current MCP version and the three before it.
If it does not connect#
| the client says | what it means |
|---|---|
| 401, unauthorized | no token, or the token ended. Get a new one, or sign in again |
| 403, forbidden | the account is a superuser, the technical root account of the app (refused by default), or the request came from a web page the app does not trust |
| a tool answers with an error | the app refused that action: a rule, a missing record, a value it does not accept. The message says which |
| too many requests | more than 60 changes in one minute from your account. Wait a minute |
| no MCP server at that address | the MCP server is not turned on in the live version of your app. Ask for it, then deploy |