Skip to main content
claude.ai and Claude Desktop connect to OnTime through OAuth. You will not paste an API key — you authorize the connector the way you would authorize any app.

​
Add the connector

1

Open connector settings

In claude.ai or Claude Desktop, go to Settings → Connectors → Add custom connector.
2

Enter the MCP URL

That is the only value you need. Everything else is discovered automatically.
3

Authorize

Claude sends you to OnTime’s sign-in page. Sign in with your normal OnTime credentials, then review the consent screen: which organization, which employee, and what level of access.
4

Approve

Claude receives an access token bound to you, in that organization.
5

Test it

Ask Claude:
Use OnTime to tell me who I am.
It should call ontime_whoami and come back with your name, your organization and your permissions. If it does, you are connected.

​
What happens behind the scenes

You do not have to configure any of this — it is listed so you know what the connector is doing.
PKCE and dynamic client registration happen automatically. The initial 401 is not an error — it is how the connector discovers that OnTime speaks OAuth, via the WWW-Authenticate header.

​
Access levels

OnTime offers two OAuth scopes:
ontime:readwrite does not grant more than you have. The scope is intersected with your employee role’s permissions, so authorizing it gives Claude exactly what you can already do in the app, and nothing more.If you are an ordinary employee, ontime:readwrite still cannot approve anyone’s leave.

​
Interactive views

Four tools can return a rich interactive view rather than raw text — team today, approvals, roster week and payslip.
On claude.ai these currently degrade to text. That is the designed fallback while support for interactive MCP views is still settling upstream, not a misconfiguration. Everything works; it just renders as text.

​
Revoking access

From Claude

Remove the connector in Settings → Connectors.

From OnTime

Revoke the session or the token in the admin console. Takes effect immediately.
Refresh tokens rotate on use, and reusing an old one revokes the whole family — so a stolen token stops working as soon as the legitimate client refreshes.

​
If it will not connect

Confirm the URL is exactly https://app.ontime.hosai.app/api/mcp — including /api/mcp and with no trailing slash.
The connector could not discover the authorization server. Check that https://app.ontime.hosai.app/.well-known/oauth-protected-resource returns JSON in a browser.
That is your permissions, working as intended. Ask Claude to run ontime_whoami and compare against the tool catalog.
More in Troubleshooting.