Skip to content

docs: Claude Team/Enterprise org-wide connector setup + service client guidance#118

Open
asachs01 wants to merge 1 commit into
mainfrom
docs/claude-team-enterprise-setup
Open

docs: Claude Team/Enterprise org-wide connector setup + service client guidance#118
asachs01 wants to merge 1 commit into
mainfrom
docs/claude-team-enterprise-setup

Conversation

@asachs01

Copy link
Copy Markdown
Member

Why

A customer setting up Claude Teams with the MCP gateway pasted their service client (svc_) credentials into the custom connector's optional OAuth Client ID/Secret fields and hit an opaque error. Root cause (verified against prod):

  • Those Advanced fields only override the client identity used in the authorization_code + PKCE browser flow (they exist for servers without Dynamic Client Registration).
  • svc_ clients live only in service_clients and are validated solely by the client_credentials branch of /oauth/token/oauth/authorize rejects them with invalid_client: Unknown client_id.
  • The creds themselves were valid: client_credentials mint + MCP initialize both succeed via curl.

What

  • gateway.astro: new Claude Team & Enterprise — Organization-Wide Setup section (admin: Organization settings → Connectors → Add → Custom → Web; members: Customize → Connectors → Connect), a warning callout to leave the OAuth fields blank, and a new Service Clients — API & Automation Access section with a token-mint curl example and Claude API mcp_servers usage.
  • teams.astro: Step 4 now cross-links the org-wide setup section and repeats the one-line warning.

Navigation steps verified against Anthropic's current custom-connector help article. astro build passes (70 pages).

🤖 Generated with Claude Code

…lient guidance

Customers setting up Claude Teams were pasting gateway service client
(svc_) credentials into the custom connector's optional OAuth Client
ID/Secret fields, which fails with invalid_client — those fields only
override the client used in the authorization_code+PKCE browser flow,
while svc_ clients are client_credentials-only.

- New 'Claude Team & Enterprise — Organization-Wide Setup' section on
  the gateway page (admin adds connector org-wide, members click Connect)
- Warning callout: leave the OAuth fields blank; gateway supports DCR
- New 'Service Clients — API & Automation Access' section with token
  mint example and Claude API mcp_servers usage
- Cross-link + warning in the Teams page Step 4

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

1 participant