Skip to main content
Organization owners can manage external access from Settings, then API & MCP in the web dashboard. This page explains the controls you have. It is not available in the mobile app.

​
What you can connect

  • API keys let a server-to-server integration read the CRM data and reports you allow.
  • MCP connections let a compatible AI client use the same scoped CRM capabilities through a secure connection.
  • Financial reporting is read-only. ShineCRM calculates the report values. Your connected assistant can analyze and explain them, but cannot charge, refund, or change money.
You choose a permission preset or individual scopes for every credential. A listed capability does not grant permission by itself.

​
API endpoint

Use the API base configured for your ShineCRM environment. Production uses the deployed Supabase Functions base, not a separate api.shinecx.com host. The deployment sets EXTERNAL_ACCESS_PUBLIC_BASE_URL to that base, for example https://<project-ref>.supabase.co/functions/v1 or the established custom Functions domain. If it is not set, the server derives the same base from SUPABASE_URL. The production OAuth and API base is https://awxqguvozrcqiwdnomol.supabase.co/functions/v1. The exact discovery and OAuth endpoints are:
  • GET https://awxqguvozrcqiwdnomol.supabase.co/functions/v1/mcp-server/.well-known/oauth-protected-resource
  • GET https://app.shinecx.com/.well-known/oauth-authorization-server
  • POST https://awxqguvozrcqiwdnomol.supabase.co/functions/v1/external-access/oauth/register
  • GET https://awxqguvozrcqiwdnomol.supabase.co/functions/v1/external-access/oauth/authorize
  • POST https://awxqguvozrcqiwdnomol.supabase.co/functions/v1/external-access/oauth/token
API-key requests use the same Functions base and send the key as Authorization: Bearer <api-key>. Available routes include:
  • GET /external-access/v1/contacts
  • GET /external-access/v1/contacts/{contact_uuid}
  • GET /external-access/v1/jobs
  • GET /external-access/v1/estimates
  • GET /external-access/v1/invoices
  • GET /external-access/v1/conversations
  • GET /external-access/v1/messages
  • GET /external-access/v1/services
  • GET /external-access/v1/schedules
  • GET /external-access/v1/financial_reports
  • GET /external-access/v1/inactive_drafts
  • GET /external-access/v1/activity
  • POST /external-access/v1/contacts/{contact_uuid}/notes
To create an internal contact note, send JSON to the contact note route. This requires contacts.notes.write and does not contact the customer.
EXTERNAL_ACCESS_WEB_BASE_URL must point to the operator dashboard. It defaults to the established https://app.shinecx.com production URL and is used only for the owner consent screen.

​
Keep access under your control

Before you create a key or connection, an owner must accept the current external-access acknowledgement and turn on the organization-wide access switch. Every credential has a label, expiry, last-used record, and revoke control. Keys are shown once when created and are stored as hashes, so a lost key must be replaced. Turning off the global switch immediately blocks every external key and connection. You can also revoke one credential without affecting the rest.
Never paste an API key into a chat, spreadsheet, or customer message. Treat it like a password.

​
Customer communications

Customer SMS is available only through a compatible MCP client. It uses separate communications.sms_batch.prepare and communications.sms_batch.approve_and_queue permissions. Neither permission is included in a preset, and both start off. Approve-and-queue can only be granted by an organization owner through OAuth. The prepare tool creates an immutable proposal for up to 10 exact recipients and message bodies, which Claude must display in chat. Nothing is queued until the owner makes a second approve-and-queue tool call for that unchanged proposal. There is no dashboard approval click and no campaign page. ShineCRM proves the owner-bound second tool call and the immutable exact proposal. It does not observe or trust Claude’s confirmation interface. The 10-minute deadline applies only to approving the prepared proposal. Approval must happen before then. Once the exact immutable batch is approved, it may remain queued through quiet hours and 20 to 40 second safety pacing. Before each provider call, ShineCRM rechecks authorization and revocation, current terms and entitlement, recipient STOP and opt-out status, archive and phone eligibility, messaging gates, and pacing. Every unavailable or failed check prevents that provider call. A definitive denial or recipient eligibility failure stops the affected send or batch. A transient verification failure leaves it queued for a safe retry. The organization is responsible for message content and for having lawful authority and any required recipient consent. SMS can incur Twilio, carrier, and ShineCRM usage charges and can create legal-compliance and sender-reputation risk.
Never choose Claude’s Allow always option for approve-and-queue. Disable that write tool when using Research. Every queued SMS remains subject to ShineCRM’s consent, opt-out, quiet-hours, sender-registration, subscription, usage, and idempotency safeguards, and counts toward the organization’s messaging usage.

​
Frequently asked

Can an AI assistant send money or issue a refund? No. Financial access is read-only. Can I see provider costs through an API key? No. Provider cost figures are not exposed through organization access. What if a team member leaves? An owner should revoke their related connection or key from Settings, then API & MCP.