Skip to main content
Claude.ai and ChatGPT on the web can connect to plamotrack as a custom connector — without you pasting a token. Instead, they use OAuth: you’re redirected to sign in at your identity provider (Google, Keycloak, Authentik, etc.) and the client receives its own access tokens. This requires OIDC mode and a public HTTPS URL.

​
Requirements

Before you connect Claude.ai or ChatGPT, make sure all of these are in place:
  • plamotrack running in OIDC mode (AUTH_MODE=oidc) — see OIDC Login
  • TLS in front of your instance, with PUBLIC_BASE_URL set to an https:// address — see VPS + Caddy or Cloudflare Tunnel
  • MCP_OAUTH_SIGNING_KEY set in .env (generate one with openssl rand -hex 32)
  • Your OIDC provider client configured with a second redirect URI: <PUBLIC_BASE_URL>/mcp/auth/callback

​
Connecting Claude.ai

1

Open Integrations in Claude.ai

In Claude.ai, go to Settings → Integrations (or the custom connector section, depending on your plan).
2

Add the connector URL

Add a new connector and enter your plamotrack MCP endpoint:
3

Let Claude discover your instance

Claude.ai discovers your instance as an OAuth server and redirects you to sign in.
4

Sign in at your identity provider

Sign in at your identity provider — for example, Google. Only your owner account is accepted; any other account is refused before a token is issued.
5

Done

Claude.ai receives its own access token and stores it. There’s nothing to paste or keep track of.

​
Connecting ChatGPT

Follow the same steps, starting from Settings → Connectors in ChatGPT, and enter the same connector URL (https://your-instance.example/mcp/). The sign-in flow is identical.

​
What access does the connected client get?

Each connected client gets read and write access to your collection — the same as a read-and-write personal access token. It can log orders, move kits, adjust stock, and look up anything in your collection. It cannot change instance settings, run a replace-all import, or manage access tokens. Those stay with your browser session and are never exposed to a connected client.

​
Removing a connected client

To disconnect a client, revoke its access in your identity provider’s settings — go to the provider’s connected apps or authorised clients page and remove the plamotrack entry. The client’s access ends the next time it tries to refresh its token. To revoke all OAuth-linked MCP clients at once — for example, if you’re changing identity providers — use the rebind-oidc recovery command described in the operations guide. This clears every MCP grant and, best effort, revokes the provider’s refresh tokens behind them. Your collection data, browser session, and personal access tokens are untouched. Any client that was linked can sign in again once you’ve reclaimed the instance.
Personal access tokens still work in OIDC mode. If you also use Claude Desktop with a token, it keeps working exactly as before — you don’t need to change its configuration.
Gemini Spark and other AI assistants that support MCP OAuth should work the same way — add the connector URL https://your-instance.example/mcp/ in their settings and sign in when prompted.