Connect your AI agent to FavCRM

1. Choose the right OAuth 2.1 resource URL

FavCRM separates MCP capabilities into three distinct endpoints so you decide the maximum blast radius before signing in.

Most MCP servers expose every read and write tool behind a single URL, leaving you to hope a prompt never triggers an unintended update. FavCRM splits access at the resource layer on https://mcp.favcrm.io.

If you only want morning summaries, client history lookups, or package expiry checks, connect https://mcp.favcrm.io/mcp/oauth/view. Write tools are not registered on that resource, so the assistant cannot alter records even if prompted.

• https://mcp.favcrm.io/mcp/oauth/view — Read-only contacts, deals, tasks, and bookings (Starter $0+).
• https://mcp.favcrm.io/mcp/oauth/manage — Read + booking schedule and appointment management (Simply Booking & Pro).
• https://mcp.favcrm.io/mcp/oauth/crm — Full CRM contacts, deals, tasks, and message drafts with Approval Guard support (FavCRM Pro).

2. Connect Claude or ChatGPT via OAuth 2.1

Remote MCP clients that support OAuth 2.1 + PKCE connect without copying long-lived API secrets onto your laptop.

Open your AI client’s connector settings (for example, Claude Settings → Connectors → Add custom connector, or ChatGPT Settings → Connectors). Paste the FavCRM resource URL you selected in Step 1.

Your browser opens FavCRM’s authorisation screen showing the workspace name and exact permission scopes requested. Once approved, your assistant receives a workspace-scoped token tied to your user role.

• Confirm you are signed into the intended FavCRM company workspace before authorising.
• Run a verification prompt: “List my upcoming confirmed bookings for tomorrow and any overdue tasks.”
• Check Settings → Integrations in FavCRM to confirm the connected app appears in your active list.

3. Connect Cursor or local scripts with a scoped key

When an IDE or automation script does not yet run interactive browser OAuth, generate an explicit-scope MCP key.

In the FavCRM merchant portal, navigate to Settings → Integrations → MCP Keys and click Create Key. Choose a scope preset (Read-Only, Booking Ops, or CRM Follow-Up); FavCRM rejects keys with zero scopes selected so you never create an ambiguous credential.

Store the token in an environment variable rather than committing it to git, and point your MCP client at https://mcp.favcrm.io/mcp with an Authorization: Bearer header.

• Name each key after the device and tool (for example, “MacBook Cursor — Read Only”).
• Rotate or delete keys immediately when switching machines or contractors.

4. Configure Approval Guard and audit reviews

Approval Guard keeps outbound client messages, discounts, refunds, and sensitive CRM mutations behind human confirmation.

On FavCRM Pro, toggle Approval Guard ON under Settings → Integrations. When an AI assistant proposes a sensitive write or drafts a customer renewal message, FavCRM records the proposal in your review queue instead of executing it silently.

Every tool invocation—whether read-only, direct booking update, or approved draft—is written to your workspace audit trail with the actor source, timestamp, and affected client record.

Operator security checklist before going live

Five habits that keep connected AI useful and predictable across a service team.

1. Start every new team member or AI client on /mcp/oauth/view before granting write scopes.
2. Keep Approval Guard enabled whenever /mcp/oauth/crm is connected to a live client list.
3. Never paste raw customer phone lists or payment exports into unauthenticated chat sessions.
4. Name every MCP key after a single device so you can revoke one laptop without breaking others.
5. Review Settings → Integrations monthly and revoke stale OAuth sessions.

Frequently asked questions