Skip to main content
The MCP server is accessible at a single HTTPS endpoint:
Clients discover authentication endpoints, register dynamically, and initiate the standard OAuth 2.1 authorization code flow with PKCE without requiring local binary installations.

​
Add connector

1

Open Settings → Connectors

Select Add custom connector.
2

Enter endpoint URL

Enter https://api.orriven.com/mcp and confirm. Claude dynamically registers with orriven and initiates the authorization redirect.
3

Authorize access

Sign in if prompted, review requested permissions, and select Allow. Enable the connector in target conversations.
When a client connects for the first time with an account, orriven displays an authorization consent screen in the console.
Claude requests access to orriven on behalf of user@example.com.
Redirect destination: claude.ai
Granting access delegates developer and organizational management permissions matching the authenticated user account.

Authorization consent details: client identifier, verified redirect URI, and permission scope.

Key verification points during authorization:
  • Authentication status: Unauthenticated sessions require signing in via password or enterprise SSO before completing authorization.
  • Redirect URI validation: Verify the displayed redirect domain matches the client provider (claude.ai for Claude.ai, or localhost for local tools).
  • Consent action: Allow completes authentication and issues an OAuth access token. Deny cancels the authorization request.
Authorization persists per client application and account. Subsequent sessions reuse the active credential until revocation or expiration.
Only authorize requests initiated directly from your active session. Do not authorize requests originating from untrusted links or external messages.

​
Initial workflow

After connection, query organizational structure to obtain resource identifiers:
  1. List organizations: Invoke list_organizations to retrieve accessible organizations and roles.
  2. List Business Units: Invoke list_workspaces with the target organizationId to retrieve Business Unit IDs.
  3. Provision API keys: Invoke create_api_key or create_publishable_key with the target workspaceId.
The plaintext API secret (osk_…) is returned only once in the initial tool response. Store this credential directly in a secure key management system or environment variable.

​
Disconnect

To remove an integration, delete the connector configuration within the client application (for example, in Claude.ai Connector Settings or by running claude mcp remove orriven). Access tokens remain valid for 1 hour, renew automatically during active use, and expire after 7 days of inactivity. For full details on token lifecycle and revocation policies, see Security & authorization.