Connect a client
Add the SaaSFlow MCP server to Claude, ChatGPT, Cursor, or your own client.
Every client talks to the same server over HTTPS:
https://mcp.saasflow.comConnectors set up with the earlier address, https://api.saasflow.com/mcp, keep working
as they are.
Most clients only need that URL. They discover the auth flow from the endpoint itself
(RFC 9728 metadata at /.well-known/oauth-protected-resource on the same host), identify
themselves with a Client ID Metadata Document (Claude, ChatGPT) or dynamic client
registration (Cursor and others), and send you to app.saasflow.com to sign in and
approve.
In the app, the robot icon at the bottom of the sidebar shows the address with a copy button, and User settings → Connect AI has the setup steps below.
By client
| Client | Setup |
|---|---|
| Claude (web, desktop, mobile) | Settings → Connectors → Add custom connector, paste the URL. |
| ChatGPT | Add it as a connector. Same URL, same OAuth flow. |
| Claude Code | claude mcp add --transport http saasflow https://mcp.saasflow.com |
| Cursor | { "mcpServers": { "saasflow": { "url": "https://mcp.saasflow.com" } } } in .cursor/mcp.json |
| Your own client | Streamable HTTP transport, bearer auth. See OAuth for apps. |
A client that speaks only stdio can bridge to the endpoint:
{
"mcpServers": {
"saasflow": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.saasflow.com"]
}
}
}mcp-remote is a third-party bridge, not a SaaSFlow package.
OAuth
| Field | Value |
|---|---|
| Authorization endpoint | https://api.saasflow.com/auth/oauth2/authorize |
| Token endpoint | https://api.saasflow.com/auth/oauth2/token |
| Resource | https://mcp.saasflow.com, or the URL you connected to (https://mcp.saasflow.com/mcp, https://api.saasflow.com/mcp) |
| Scopes | saasflow:read, saasflow:write |
Issued tokens have the resource as their audience, and any of the three works on every MCP address. SaaSFlow stores the consent grant; disconnecting the app under User settings → Connected apps invalidates the token in real time.
| Scope | Grants |
|---|---|
saasflow:read | All :read permissions, intersected with your user permissions. |
saasflow:write | Reads + :write permissions. Admin (:manage) is never granted via OAuth. |
saasflow:read is enough for questions and analysis. Write tools
are registered only when the token carries saasflow:write.
On the consent screen, read access is always included and write access is a checkbox
that starts unticked. Tick Make changes to company data to grant saasflow:write.
To change it later, disconnect the app and connect again.
API keys
For scripts, CI, and clients that would rather send a fixed header than run a browser flow, pass an API key as the bearer token:
Authorization: Bearer sf_live_...A key belongs to one company, so tool calls can omit companyId. Write tools are
registered, bounded by the key's permission set.
Get a token for testing
The saasflow CLI can mint an OAuth bearer:
saasflow login
# Then to print a fresh access token:
saasflow whoami --json | jq -r '.oauth.accessToken'Useful when wiring up a custom MCP client.
Revoke
Open User settings → Connected apps in the SaaSFlow app. Every app you connected with OAuth is listed there, and disconnecting is immediate. API keys are revoked under Settings → API keys.