> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kadoa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Service Connector

The MCP service connector connects applications and organization members to the Kadoa MCP server through a shared workspace service account for programmatic access. A workspace admin generates OAuth client credentials once and everyone who connects through them acts as the service account, with no individual Kadoa accounts or login prompts.

<Info>
  For individual access using your own Kadoa account, see [MCP Server setup →](/docs/sdk/mcp#setup).
</Info>

## Setup

1. In Kadoa, open **Settings → General → MCP service connector**.
2. Select **Generate credentials** and copy the MCP server URL, OAuth client ID, and OAuth client secret. The secret is shown once.
3. A Claude organization owner opens **Admin settings → Connectors → Add custom connector**.
4. Enter `https://service.mcp.kadoa.com/mcp`, then paste the OAuth client ID and secret under Advanced settings.
5. In the connector's tool settings, allow only the tools that organization members should use.
6. Organization members open **Settings → Connectors**, find the custom connector, and select **Connect**.

## How it works

The connector is an OAuth client (a client ID and secret) registered with Kadoa for your workspace. When an organization member selects **Connect** in Claude, the OAuth handshake completes silently against `https://service.mcp.kadoa.com/mcp`, with no Kadoa login or consent screen. The resulting session acts as your workspace's shared service account.

* The service connector uses a separate hostname from the personal connector at `https://mcp.kadoa.com/mcp`, so users can configure both side by side.
* All members share the same service-account identity and team, and team switching is unavailable.
* Each workspace has at most one active connector.

<Note>
  The service connector acts as the workspace service account: every tool call runs under the shared service account and its team, and workflow [history](/docs/workflows/states) records the service account, not the individual member who ran the action. If you need per-user attribution, use the [personal connection](/docs/sdk/mcp#setup).
</Note>

## Supported clients

Claude (Team and Enterprise custom connectors) is supported today. Other MCP clients need their OAuth redirect URI registered with Kadoa first. [Contact support](https://www.kadoa.com/contact?type=support) to enable one.

## Manage access

* The client secret is shown once, at generation or rotation. Store it securely.
* To rotate credentials, select **Rotate secret** in Kadoa, replace the secret in Claude's connector settings, and reconnect. Rotation immediately invalidates tokens issued with the previous secret.
* To stop all access immediately, select **Revoke connector**.
* To limit what members can do, restrict the allowed tools in the MCP client's connector settings.

<Warning>
  Never paste a Kadoa workspace API key into any MCP client. The service connector's OAuth credentials are the only credentials that belong there.
</Warning>