# Connect an AI agent to Clara

> Canonical: https://heyitsclara.com/auth.md
>
> Last updated: 2026-08-28

Clara uses OAuth 2.1 with PKCE for its authenticated MCP server. Never ask a person to paste a Clara password, access token, or client secret into a prompt.

## Start here

1. Discover the protected resource metadata at https://mcp.heyitsclara.com/.well-known/oauth-protected-resource
2. Discover the authorization server at https://mcp.heyitsclara.com/.well-known/oauth-authorization-server
3. Register the public client dynamically at https://mcp.heyitsclara.com/register
4. Send the person through https://mcp.heyitsclara.com/authorize with PKCE using S256
5. Exchange the returned code at https://mcp.heyitsclara.com/token
6. Connect to https://mcp.heyitsclara.com/mcp using MCP 2025-06-18 over Streamable HTTP

An unauthenticated MCP request returns a `401` challenge that points to the protected resource metadata. Clara issues no client secret and currently advertises no OAuth scope vocabulary. Access is limited to the signed-in person's Clara businesses, and clients confirm write tools before running them.

## Permissions and revocation

- Every request carries the individual Clara user's own credential. There is no cross-tenant key and no shared service account.
- A connection can only reach the businesses on the account that authorized it. Clara's backend enforces tenancy on every call, not the MCP layer.
- Write tools change a live receptionist, so MCP clients ask the person to confirm each call before it runs.
- Access ends when the person disconnects Clara in their assistant or revokes the connection from the Clara web app. Nothing keeps working on its own afterwards.
- Per-user rate limits, a global concurrency cap, request timeouts, and a circuit breaker protect the Clara backend behind the MCP server.
- No OAuth scope vocabulary is issued yet, so a client cannot currently request read-only access at the token level. Least-privilege today means connecting only the account that needs it and confirming writes.

## Related descriptors

- Developer documentation: https://heyitsclara.com/developers/
- MCP server card: https://heyitsclara.com/.well-known/mcp.json
- OpenAPI description: https://heyitsclara.com/openapi.json
- API catalog: https://heyitsclara.com/.well-known/api-catalog

Questions: support@heyitsclara.com