Skip to main content
Claude Code can set headers, so it uses an API key directly — no OAuth flow needed.

​
Option 1 — add the server directly

1

Issue an employee-bound API key

In the admin console: API & webhooks → Issue key. Bind it to the employee you want the agent to act as.
Bind it to an employee. An unbound service key cannot call any self-service or scope-checked tool — no punching, no approvals, no “my” anything.
The key is shown once. Copy it.
2

Add the server

3

Verify

Claude calls ontime_whoami and reports your identity, organization and permissions.

​
Option 2 — install the plugin

The plugin wires the same server and ships three skills that teach Claude how to operate OnTime properly.
1

Add the marketplace

2

Install

3

Set the environment variables

ONTIME_MCP_URL defaults to http://localhost:3000/api/mcp for local development, so set it explicitly when pointing at a real instance.

​
The three bundled skills

Skills load automatically when the conversation matches what they cover.
Loads for essentially any OnTime work. Covers:
  • Grounding with ontime_whoami before anything else.
  • The self-service versus on-behalf split — most domains are two separate tools, not one with an optional employeeId. This is the single biggest source of agent errors, and this skill exists largely to prevent it.
  • Which tool for which job, id and date conventions, pagination, error recovery.
  • The four confirm-gated tools, and the requirement to get an explicit human “yes” first.
  • A full annotated catalog of all 71 tools.
Loads for attendance work: missed punches, regularization queues, overtime approvals, day corrections — end to end rather than tool by tool.
Loads for payroll and compliance: the five-stage cycle, what to verify between stages, and disbursement sign-off.Payroll is a state machine where calling a stage out of order fails, so this one is worth having loaded before you start rather than after the first refusal.

​
Which employee should the key be bound to?

The agent inherits that person’s authority exactly. Choose deliberately:
Binding to an Admin gives the agent the run of the organization — including disbursing payroll. The confirm gates help, but the right first step is to bind narrowly and widen when you need to.

​
Rotating the key

There is no rotate action. Issue a new key, update ONTIME_API_KEY (or re-add the server), then revoke the old one.

​
If a tool is missing

Not a bug — a permission. Run ontime_whoami and compare against the tool catalog. Listing and calling share the same check, so a tool you cannot see is one you could not call anyway.