How sign-in works#
The Convirza MCP server uses OAuth 2.0 (authorization code with PKCE), the authentication model the MCP specification defines and the one Claude, ChatGPT and other clients expect. In practice:1.
You add the server URL to your client.
2.
The client registers itself with Convirza automatically (dynamic client registration) — you never handle client IDs or secrets.
3.
The client opens the Convirza sign-in page at connect.convirza.com. You enter your Convirza email and password on that page, not in the assistant. Your credentials are verified by Convirza and never shared with the assistant.
4.
Convirza issues the client an access token scoped to your account.
5.
Every request the assistant makes from then on runs as you.
Token lifetime#
| |
|---|
| Access token | 7 days |
| Refresh | Automatic — the client renews the token without asking you to sign in again |
| Re-authentication | Only if the refresh token is revoked or expires, or you disconnect |
You will typically sign in once and not think about it again.For developers: OAuth endpoints#
Clients discover these automatically. Listed for reference.| Endpoint | Purpose |
|---|
https://connect.convirza.com/.well-known/oauth-authorization-server | Discovery metadata |
https://connect.convirza.com/register | Dynamic client registration |
https://connect.convirza.com/authorize | Sign-in and authorization |
https://connect.convirza.com/token | Token issue and refresh |
Supported: authorization_code and refresh_token grants, PKCE (S256), public clients (token_endpoint_auth_method: none).
What your role can do#
The MCP server has no permissions of its own. It does exactly what your Convirza account can do, and nothing more — every tool call is authorized by the same rules as the Convirza API. Your role determines the outcome:| Role | Read (calls, transcripts, scores, reports, users, campaigns, numbers…) | Operational actions (routing, geo-locations, tags, call notes, DNI, broadcasts…) | Account administration (create/edit users, groups, campaigns, webhooks, subscriptions, scorecards) |
|---|
| Admin | ✅ | ✅ | ✅ |
| Standard | ✅ | ✅ | ❌ |
| Read-Only | ✅ | ❌ | ❌ |
| Other roles (Account Admin, Identified-only, Convirza internal roles) | ❌ Cannot use the MCP server | | |
When a request is outside your role, the server returns a clear message rather than acting. For example, a Read-Only user asking to change something sees:You don't have permission for this action. Your role (Read Only) can only read data — this endpoint changes data. Contact your account administrator to request write access.
Your assistant will relay that to you. It is not an error with the connection — it is the server respecting your permissions.Visibility follows your account, too. The users and groups you can see through the assistant are the ones your Convirza account is entitled to see.
Confirmation before changes#
Most assistants ask you to confirm before running a tool that changes data. Keep that on. The server will do what you ask; the confirmation step is where you catch a misunderstanding before it becomes a change to your account.
Disconnecting and revoking access#
To stop an assistant's access, remove the Convirza connector from that client:Claude: Settings → Customize → Connectors → remove the Convirza connector
Claude Code: claude mcp remove convirza
ChatGPT: Settings → Apps & Connectors → remove the connector
Cursor / VS Code / Codex: delete the convirza entry from the config file shown in the Quickstart
Security notes#
Your password is entered only on connect.convirza.com and is never transmitted to, stored by, or visible to the assistant.
Tokens are scoped to your account and expire automatically.
The server can only do what your role permits — it is not a privilege escalation path.
As with any tool your assistant can call, keep confirmation prompts on for actions that change data, and be thoughtful about combining this server with untrusted content or other servers in the same session.
Modified at 2026-09-04 11:37:50
