#claude.ai connector

1. In claude.ai open Settings → Connectors → Add custom connector.
2. Name: X3, URL: https://api.x3.example/mcp (your API host, exactly – no redirects).
3. Leave the OAuth client fields empty: Claude registers itself (dynamic client registration or a client metadata document).
4. Connect → sign in to X3 → consent → done. In a chat, enable the connector under the tools menu. On the consent page choose only the project you want to analyse and Read only – write access can also change conversions and ad account settings.
5. Test it: ask "Wie lief meine Website letzte Woche?" The onboarding's step Claude verbinden shows the call in its function test (Guided onboarding).

Organization owners on Team/Enterprise plans add the connector once for the workspace; every member then connects with their own X3 account.

#Consent

The grant can never exceed your role: on every request X3 intersects the grant with your current membership. Revoke it in the dashboard's account settings (Connected apps); organization admins see and revoke all grants of their organization. Revoking also invalidates refresh tokens and keys created through the grant. Changing your password or "log out everywhere" revokes all your grants as well – reconnect afterwards.

#How the OAuth flow works

X3 is its own OAuth 2.1 authorization server; nothing else needs to be configured.

• Access tokens (x3oat_…) live one hour and are only valid for /mcp (audience binding). Refresh tokens (x3ort_…) slide for 180 days; reuse of a rotated refresh token outside a 30-second grace window revokes the whole grant.
• The login and consent pages are server-rendered without JavaScript, in English or German (Accept-Language), and cannot be framed.
• The 401 challenge always asks for the full read-and-write scope set plus offline_access, so Claude never needs a step-up for normal work. Admin and personal-data scopes are requested only when a tool needs them (403 insufficient_scope challenge).

#Requirements for self-hosted deployments

Claude's servers connect to your API from Anthropic's network. The API host must

• be reachable over public IPv4 with a valid TLS certificate;
• answer /mcp and the OAuth endpoints without redirects;
• allow Anthropic's egress range 160.79.104.0/21 through any WAF;
• answer the token endpoint in well under 10 seconds (Neon cold starts are fine; X3 answers 503, never 401, while the database wakes up).

Set X3_PUBLIC_API_URL to the public origin; X3_OAUTH_ISSUER only when the issuer must differ.

#Troubleshooting