Authentication & Access

You connect your assistant by signing in with your Convirza account. It uses OAuth 2.0, the standard sign-in method Claude, ChatGPT and other assistants expect. Here's what happens:

Add the server

You add https://connect.convirza.com/mcp to your client.

The client registers itself

The client registers with Convirza automatically. You never handle client IDs or secrets.

You sign in on Convirza's page

The client opens the Convirza sign-in page. Sign in with your email and password, Continue with Google or Continue with Microsoft. You sign in on Convirza's page, not in the assistant, and the assistant never sees your password.

The client gets a token

Convirza gives the client an access token for your account. Every request the assistant makes from then on runs as you.

Google and Microsoft sign-in only work if your Convirza account already uses them. If you don't have an account yet, start free first, then connect.

Token lifetime

Item	Detail
Access token	7 days
Refresh	Automatic. The client renews the token without asking you to sign in again
Signing in again	Only if you disconnect, or the refresh token is revoked or expires

You will usually sign in once and not think about it again.

For developers: OAuth endpoints

Clients discover these automatically. They are listed for reference.

Endpoint	Purpose
`https://connect.convirza.com/.well-known/oauth-protected-resource`	Protected resource metadata
`https://connect.convirza.com/.well-known/oauth-authorization-server`	Authorization server metadata
`https://connect.convirza.com/register`	Dynamic client registration
`https://connect.convirza.com/authorize`	Sign-in and authorization
`https://connect.convirza.com/token`	Token issue and refresh

Supported: the authorization_code and refresh_token grants, PKCE (S256), and the token endpoint auth methods none (public clients) and client_secret_post.

What your role can do

The MCP server has no permissions of its own. It does exactly what your Convirza account can do, and nothing more. Every tool call is checked by the same rules as the Convirza API.

Role	Read	Everyday actions	Account admin
Admin	✅	✅	✅
Standard	✅	✅	❌
Read-only	✅	❌	❌

Read: calls, transcripts, scores, reports, users, campaigns and numbers.

Everyday actions: routing, numbers, geo-locations, tags, call notes, DNI, SMS broadcasts and uploading calls.

Account admin: users, groups, campaigns, webhooks, subscriptions and scorecards.

Other roles can't use the MCP server: Account Admin (a separate role from Admin), Identified-only and Convirza internal roles.

When a request is outside your role, the server returns a clear message instead of acting. For example, a Read-only user asking to change something sees:

You don't have permission for this action. Your role (Read Only) can only read data, and this endpoint changes data. Contact your account administrator to request write access.

Your assistant relays that message. It isn't a connection problem: the server is respecting your permissions.

Visibility follows your account too. You see the users, groups and calls your Convirza account is entitled to see.

Before your assistant changes something

Most assistants ask before running a tool that changes data. Read each request before you approve it. Changes take effect immediately, so the approval step is where you catch a misunderstanding.

Disconnecting

To stop an assistant's access, remove the Convirza connector from that client:

Claude: Customize, then Connectors, then remove Convirza

Claude Code: claude mcp remove convirza

ChatGPT: Plugins, then remove the Convirza plugin

Cursor, VS Code, Codex: delete the convirza entry from the config file shown in the Quickstart

Removing the connector discards the token that client held. Any token the client still held stops working within 7 days.

Security notes

You enter your password only on Convirza's sign-in page. It is never sent to, stored by or shown to the assistant.

Tokens are tied to your account and expire automatically.

The server can only do what your role permits.

Read requests that change data before you approve them.

Take care when combining this server with untrusted content or other servers in the same chat.

Authentication & Access

How sign-in works#

Token lifetime#

For developers: OAuth endpoints#

What your role can do#

Before your assistant changes something#

Disconnecting#