Before you connect
An organization owner must accept the current connected-agent acknowledgement and turn on external access. The owner chooses a permission preset or individual scopes for the connection. The server uses short-lived connection credentials and rotating refresh credentials. Connections are bound to your organization on the server. A client cannot choose another organization’s ID.Connect a compatible client
Paste the production MCP server URL into your compatible client:https://awxqguvozrcqiwdnomol.supabase.co/functions/v1/mcp-server
Compatible clients discover protected-resource metadata automatically from the MCP server URL. For advanced client implementations, that metadata is available at https://awxqguvozrcqiwdnomol.supabase.co/functions/v1/mcp-server/.well-known/oauth-protected-resource. It points the client to the authorization issuer at https://app.shinecx.com. The issuer’s standard discovery document is available at https://app.shinecx.com/.well-known/oauth-authorization-server and advertises the production authorization, token, and Dynamic Client Registration endpoints.
Compatible public clients register their exact HTTPS callback URI, use authorization code with PKCE S256, and send the MCP server URL as the OAuth resource indicator. During browser authorization ShineCRM sends the owner to the web dashboard, where the owner sees the client name and exact callback destination, selects granular scopes, and explicitly approves or denies the request. Approval redirects only to the exact registered callback URI.
Claude
Individual users on Claude web open Customize, choose Connectors, then Add custom connector. Paste the ShineCRM MCP server URL and choose Add or Connect. Team and Enterprise owners or admins open Organization settings, choose Connectors, then Add custom connector. After the connector is added for the organization, members open Customize, choose Connectors, then Connect. Complete the ShineCRM permission screen when prompted. Claude plan and workspace controls determine whether custom connectors are available. Claude’s documented callback ishttps://claude.ai/api/mcp/auth_callback. It is registered dynamically like every other public client, rather than allowlisted privately.
ChatGPT
In ChatGPT on the web, open Settings or Workspace settings, then Apps, and enable Developer mode. Choose Create, paste the ShineCRM endpoint, select OAuth with Dynamic Client Registration, then choose Scan tools. Complete the ShineCRM permission screen when prompted. Full read and write MCP tools are available on Business, Enterprise, and Edu web plans. Pro custom MCP is limited to read and fetch tools. Custom MCP is not available on mobile or in Agent mode.Gemini Spark
Eligible personal Google accounts can add ShineCRM to a Gemini Spark custom app. In Gemini on the web, open Settings & help, choose Connected Apps, then Custom apps for Spark. Choose Add a custom app, paste the ShineCRM URL, choose Next, and complete ShineCRM OAuth when prompted. Spark eligibility can be restricted by account type, region, or product availability. Ordinary Gemini chat and the Gemini Interactions API do not support remote MCP.Developer clients
Compatible developer clients use the ShineCRM URL as a Streamable HTTP MCP endpoint. They must discover OAuth from the endpoint, implement Dynamic Client Registration and authorization code with PKCE, store short-lived access credentials securely, and rotate refresh credentials on every use. OpenAI Responses API clients can use the remote MCP server with an OAuth access token. Antigravity preview clients must implement the complete OAuth lifecycle. The Gemini Interactions API cannot connect to a remote MCP server. Provider-specific settings cannot bypass credential scopes, owner-only SMS approval, or ShineCRM’s messaging safety checks. ShineCRM advertises and accepts the standardoffline_access OAuth scope so a compatible client can keep the connection active with rotating refresh credentials. That OAuth scope does not grant access to any ShineCRM data or tool. The owner still chooses every ShineCRM permission on the consent screen.
The production API and OAuth handlers run at
https://awxqguvozrcqiwdnomol.supabase.co/functions/v1. The OAuth issuer and owner consent dashboard are https://app.shinecx.com.What a connected client can do
Depending on the scopes you grant, a client can read contacts, customer timelines, jobs, estimates, invoices, conversations, messages, services, schedules, and activity. It can add internal contact notes. It can also request read-only financial reports including revenue, invoice aging, payments and refunds, tax, estimate conversion, and revenue by service or customer where the current records support it. It can also file a bug report with the ShineCRM team when it cannot complete a request or gets a confusing result; the assistant is instructed to propose the report and file it only after you agree, and the report goes to ShineCRM, never to your customers. With the corresponding write scopes granted, a client can also create draft estimates and invoices, create jobs, and convert an estimate to a job or invoice and a job to an invoice. An owner-only scope lets a client record a manual payment against an invoice, which can send the customer the standard receipt notice. The server checks every required scope for each tool call and only lists tools the connection can use. A listed tool still does not give the client authority beyond its credential scopes. Message bodies and other customer-visible text a connected client authors are the organization’s responsibility and must not contain internal operator context.Customer communications
The MCP server can identify inactive customers and prepare individualized drafts. Customer SMS uses two granular permissions:communications.sms_batch.prepare and communications.sms_batch.approve_and_queue. Neither permission is included in a preset, and both start off. Only an organization owner can grant the approve permission through OAuth.
The first tool call prepares one immutable proposal with no more than 10 exact recipients and message bodies. Claude must show every recipient and complete message body in chat. Nothing is queued at this stage. The owner must then make a separate approve-and-queue tool call for that unchanged proposal. There is no dashboard approval click and no campaign page.
The 10-minute deadline applies only to approving the prepared proposal. Approval must happen before then. Once the exact immutable batch is approved, it may remain queued through quiet hours and 20 to 40 second safety pacing. Before each provider call, ShineCRM rechecks authorization and revocation, current terms and entitlement, recipient STOP and opt-out status, archive and phone eligibility, messaging gates, and pacing. Every unavailable or failed check prevents that provider call. A definitive denial or recipient eligibility failure stops the affected send or batch. A transient verification failure leaves it queued for a safe retry.
ShineCRM proves that the second tool call came through an owner-authorized connection and refers to the immutable exact proposal. ShineCRM does not observe or trust Claude’s confirmation interface. Each queued message still uses ShineCRM’s existing consent, opt-out, quiet-hours, sender-registration, subscription, usage, and idempotency safeguards. Messages count toward the organization’s messaging usage.
The organization is responsible for message content and for having lawful authority and any required recipient consent. SMS can incur Twilio, carrier, and ShineCRM usage charges and can create legal-compliance and sender-reputation risk.