Connect a client

Connecting takes a one-time entry in your AI client's MCP config. Add the endpoint, then sign in with your Celigo credentials when the client asks. There is no token to create or copy, and most people are running in under five minutes.

Quickstart

1. Add the server to your client. Fastest path, Claude Code:

   claude mcp add --transport http celigo https://api.integrator.io/celigo-mcp

   On any other client, paste this:

   {
     "mcpServers": {
       "celigo": {
         "url": "https://api.integrator.io/celigo-mcp"
       }
     }
   }

2. Sign in when prompted. The client opens your browser to the Celigo sign-in page. Sign in with your Celigo credentials; SSO accounts are redirected to their provider. Then pick the account and environment the agent should work in.
3. Verify. Ask the agent: "List my Celigo connections." If it returns a summary of your connections, you are connected.

For exact steps in your client, including where the config lives and the success indicator to look for, use the guide for yours:

• Claude Code
• Claude Desktop
• Cursor
• VS Code
• ChatGPT
• Windsurf
• Other MCP clients

Pick your endpoint

The endpoint is region-specific, and credentials work only in their own region.

Region	Endpoint
US	https://api.integrator.io/celigo-mcp
EU	https://api.eu.integrator.io/celigo-mcp
AU	https://api.au.integrator.io/celigo-mcp
CA	https://api.ca.integrator.io/celigo-mcp

The subdomain you sign in at is your region: integrator.io is US, eu.integrator.io is EU, au.integrator.io is AU, and ca.integrator.io is CA. OAuth sign-in routes to the tenant that matches the endpoint you configured.

How sign-in works

Platform MCP implements the MCP authorization spec (OAuth 2.1 with PKCE). When your client first connects without credentials, it discovers the Celigo authorization server, registers itself, and opens a browser:

1. Sign in with your Celigo credentials. SSO accounts are redirected to the identity provider; MFA applies if your account requires it.
2. Approve the client on the consent screen and pick the account and environment the session is bound to.
3. Return to your client. It stores the session and refreshes it automatically.

The session acts as you. The agent gets your integrator.io permissions in the chosen account and environment, exactly as in the UI. To switch to a different account or environment, disconnect the server in your client and sign in again. You are asked to sign in again only if access is revoked or the session has been unused for an extended period.

Use an API token instead

For non-interactive use — CI pipelines, scripts, or a client that does not support MCP OAuth — authenticate with a bearer token in the Authorization header. Both admin-created service tokens and personal access tokens work.

⚠️ A full-access token can read, change, and delete everything in your account. The server acts with your token's permissions. Keep the token out of version control and shared chats, and rotate it in Resources > API tokens if it is exposed. A project config file that holds your token should stay out of version control.

1. In integrator.io, go to Resources > API tokens, select + Generate token, and create either token type. Copy the token from the create dialog.
2. Add the header to the same config:

   {
     "mcpServers": {
       "celigo": {
         "url": "https://api.integrator.io/celigo-mcp",
         "headers": { "Authorization": "Bearer <YOUR_API_TOKEN>" }
       }
     }
   }

The server respects the token's permissions. Full-access tokens can do anything the account can. Personal access tokens act as the user who created them, and custom-scoped tokens are limited to their selected resources.

Troubleshooting

What you see	Usual cause and fix
No browser opens, or the client reports an auth error at startup	The client does not support OAuth for remote MCP servers, or is outdated. Update the client, or connect with an API token instead.
Sign-in says MFA setup is required	Your account requires MFA and you have not set it up. Set up MFA in integrator.io, then retry the sign-in.
Calls fail with 401 Unauthorized	Token is wrong, expired, or from the other region — or the OAuth session was revoked. Re-check the token and endpoint, or disconnect and sign in again.
Calls fail with 403 Forbidden	The signed-in user or token lacks permission for that action. Ask an admin to adjust your role, or use a token with broader scope.
Calls fail with 422 Unprocessable Entity	The agent sent invalid data. Ask it to call get_schema first to learn the correct fields.
The client will not connect	Confirm it supports Streamable HTTP and that the URL (and Authorization header, if you use a token) is correct.
Tools do not appear after editing config	Fully quit and reopen the client. Closing the window is often not enough.
The agent works in the wrong account or environment	The OAuth session is bound to what you picked at sign-in. Disconnect the server and sign in again to switch.