Browse documentation
Agent-first documentation · 2026-08-17.4 · Updated 2026-08-17 View as Markdown

Connect claude.ai to Domino with OAuth

Claude's hosted custom connectors can connect to Domino without copying an Agent Access token. Claude discovers Domino's OAuth endpoints, opens a Domino sign-in and consent page, and stores short-lived credentials for the connection.

This is account access, not documentation access. Reading https://letsdomino.io/llms.txt is public and never grants Claude access to private Domino data or tools.

Add the connector

Anthropic's current custom-connector flow is:

  1. In claude.ai, open Customize → Connectors.
  2. Under Connectors, choose Add custom connector. On a Team or Enterprise organization, an Owner or Primary Owner may need to add it under Organization connectors first.
  3. Enter a recognizable name such as Domino.
  4. Enter exactly https://letsdomino.io/mcp as the remote MCP URL.
  5. Choose Add.
  6. Choose Connect for Domino.
  7. In the Domino browser window, sign in to the Domino account you intend to connect. Domino returns to the pending connector consent screen after sign-in.
  8. Review the connector name, return hostname, and every requested ability. Leave only the abilities Claude needs selected, then choose Authorize connector.

Do not create or paste an Agent Access token into claude.ai. Domino and Claude complete Dynamic Client Registration, PKCE authorization, and token refresh automatically.

Choose the smallest useful abilities

The consent screen starts with Read selected. Add another ability only when the intended work needs it:

Ability Allows
Read Search and inspect authorized people, ideas, lists, plans, availability, and status.
Draft Create or change private planning state and prepare consequential actions.
RSVP List invitations and accept or decline an invitation.
Send Commit an eligible prepared external action after a separate explicit approval.

Do not select Send merely because Claude may need it later. A Claude confirmation dialog does not replace Domino's prepared-action review and later actions.commit contract.

Verify the connection

Adding the connector is only configuration. Authorization and tool availability are separate states.

  1. In a Claude conversation, open the lower-left + menu, choose Connectors, and enable Domino.
  2. Confirm Domino authentication shows as connected.
  3. Ask Claude to inspect Domino's available tools. The result must come from authenticated MCP initialize and tools/list, not from the public tool catalog alone.
  4. Verify the listed tools match the abilities selected on Domino's consent screen. A read-only connection must not expose draft, RSVP, or commit tools.
  5. Make one harmless read request, such as “Is my Domino calendar connected?” or “List my Ideas Lists.”
  6. Confirm the result is grounded in the intended Domino account before attempting any write.

Do not begin live QA with an invitation send, connection request, RSVP, cancellation, delete, booking, purchase, or payment.

Edit or revoke the connection

In Domino:

  1. Open Agent Access.
  2. Find the connector under OAuth Connections.
  3. Select or clear only abilities that the connector originally requested, then choose Save abilities; or choose Revoke to end the connection.

Ability changes apply to the current connection. Revocation invalidates its access and refresh tokens. It does not undo effects already confirmed.

In Claude, removing or disconnecting the connector controls Claude's saved connection. Revoke it in Domino as well when access should end authoritatively.

How the OAuth connection is protected

  • Domino publishes RFC 9728 protected-resource metadata and OAuth authorization-server metadata.
  • Claude registers as a public client through Dynamic Client Registration. Domino accepts only Anthropic's exact documented current and transition callback URLs.
  • Authorization requires Domino's authenticated web session, an unguessable client state, a one-time server session, CSRF validation, and PKCE S256.
  • Authorization codes are single-use and expire after five minutes.
  • Access tokens are bound to https://letsdomino.io/mcp, expire after 15 minutes by default, and cannot be used as Capability API tokens.
  • Refresh tokens are stored hashed, rotate on every use, and expire after 30 days by default. Reuse of an already-rotated refresh token revokes the whole connection.
  • Abilities are enforced by the same Domino capability registry used by static Agent Access tokens. OAuth never broadens them automatically.
  • Consent, token issuance, scope changes, refresh replay, and revocation create audit events without recording bearer tokens, authorization codes, or refresh tokens.

Domino currently uses Dynamic Client Registration because Anthropic documents DCR support for hosted custom connectors. The current MCP specification prefers Client ID Metadata Documents when both sides support them; Domino can add CIMD later without weakening or removing this Claude-compatible DCR path.

Other Claude surfaces

  • Claude Code or another header-capable MCP client: a static Domino Agent Access token remains supported. Store it in the client's protected header or secret configuration, never in chat or a URL.
  • Claude API / Messages API MCP connector: the calling application supplies authorization_token programmatically and owns token storage and refresh. Use a least-privilege static Agent Access token unless that application separately implements Domino's browser OAuth flow.
  • Public Claude conversation: pointing Claude at Domino's public docs can explain the product but cannot read or change the user's account.

For all client types and ChatGPT boundaries, continue with Connect ChatGPT, Claude, or another MCP client.

Claude's menus, plan eligibility, and callback transition can change. Recheck Anthropic's current custom connector setup and connector authentication reference when a current screen differs from this guide.