Docs
Developers

MCP server

Connect Claude Desktop, Claude Code, Cursor or Claude on the web to your APROS workspace over the Model Context Protocol, and control what the assistant can do.

Your APROS workspace is also an MCP (Model Context Protocol) server. An AI client connected to it can read and change your APROS data through tools that map to the public REST API, under the same permissions as an API key. There is nothing to install: the client talks to APROS over HTTPS.

The endpoint is:

https://<your-workspace>.apros.app/api/mcp
ClientHow it signs in
Claude Desktop, Claude Code, CursorWith a REST API key that you put in the client's configuration.
Claude on the webWith your APROS account: you sign in and approve the connection on a consent screen. No key is needed.

Find your connection details

  1. In APROS, open Settings → API Keys. This opens Integrations on the API tab.

  2. Select the MCP server (APROS) card.

The APROS as an MCP server panel shows your Endpoint and, under Pick your client, the exact configuration for each client, with your workspace address filled in. Opening the card needs the MANAGE_API_KEYS permission (the Administrator role has it).

Connect with an API key

Use this for Claude Desktop, Claude Code and Cursor.

  1. Create a REST API key for the assistant. In the panel, select Open API keys, then follow Create an API key. The key's scopes decide what the assistant can do: a key with only VIEW_ scopes can read but never change anything.

  2. Add APROS to your client. Replace sk-your-key-here with the key and <your-workspace> with your workspace address:

    Open Settings → Developer → Edit Config, add this to claude_desktop_config.json, and restart Claude Desktop.

    {
  "mcpServers": {
    "apros": {
      "type": "http",
      "url": "https://<your-workspace>.apros.app/api/mcp",
      "headers": { "Authorization": "Bearer sk-your-key-here" }
    }
  }
}

  3. Ask the assistant something, for example "List my open deals" or "Create a lead for Acme". It discovers what it may do from the key.

Connect Claude on the web

  1. In Claude, open Settings → Connectors → Add custom connector.

  2. Paste the endpoint, https://<your-workspace>.apros.app/api/mcp, and continue.

  3. Claude sends you to APROS. Sign in to your workspace if you are not signed in.

  4. On the consent screen, Allow Claude to access APROS? (it names the client), tick the rights the connection may use. Reads are pre-selected; anything that changes data starts off. Use Read-only, Full access or Clear all to set many at once.

  5. Select Allow.

The connection acts as you, with only the rights you ticked. The screen offers only rights you hold yourself, so the connection can never do more than you can. Each access token lasts 30 days; a client that supports token refresh renews it without asking you again.

Disconnect a client

In the MCP server (APROS) panel, the Connected clients list shows every client that connected by sign-in, Claude included, and how many tools each can see. The list is on the panel's ChatGPT tab. Select Revoke access on a client: all of its tokens stop working at once, and it has to connect again from scratch.

What a connected assistant can do

API tools. Each public API operation the credential may use becomes a tool, named after its path and action:

REST callTool
GET /api/leadsleads_list
GET /api/leads/{id}leads_get
POST /api/leadsleads_create
PATCH /api/leads/{id}leads_update
DELETE /api/leads/{id}leads_delete

A write to a whole collection gets bulk_update or bulk_delete instead. Every tool's description states its method, path and required permissions. Tools that only read (GET) are marked read-only, so a client can run them freely and ask you before anything that changes data.

Search and fetch. Two more read-only tools look records up across the workspace: search finds leads, contacts, companies, deals, tasks, projects, files, activities, invoices, quotes, products, departments, employees, channels, conversations and documents by text, and fetch reads one result in full. Both return only what the credential may see.

The API contract. The resource apros://openapi is the OpenAPI document, so the assistant can read exact request and response schemas before it builds a request.

The three inbound webhook operations are not tools: they are not called with your credential. Anything outside the public API, such as mail, calls or the AI Brain, is not reachable either. See What the API covers.

Permissions

Every tool call goes through the same REST endpoint and the same permission checks as a direct API call. The assistant cannot do anything its credential cannot:

  • With an API key: the key's scopes, within its owner's rights. See Scopes and permissions.
  • With sign-in: the rights ticked on the consent screen, within the signed-in person's rights.

The tool list is filtered by the credential. A tool is offered when the credential holds at least one of the permissions its path enforces, and the endpoint still checks the exact permission on each call, so an offered tool can answer 403 for a method the credential lacks. A key with no scopes sees no tools at all.

Rate limit

Requests made with an API key count toward that key's limit of 600 requests per minute. See Rate limits.

Protocol details

For developers building their own MCP client:

  • Transport: Streamable HTTP. Send JSON-RPC 2.0 messages with POST to /api/mcp; responses are JSON. The legacy HTTP+SSE transport is not supported, and a GET answers 405.
  • Protocol version: 2025-06-18, with the initialize handshake.
  • Methods: initialize, ping, tools/list, tools/call, resources/list, resources/read.
  • Credentials: Authorization: Bearer sk-… (a REST API key) or Authorization: Bearer <access token> from the OAuth flow below. Every method except initialize and ping needs one. A request without a valid credential answers HTTP 401 with a WWW-Authenticate header that points to the discovery document.
  • OAuth 2.1:
    • Discovery: /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server on your workspace address.
    • Dynamic client registration at /api/oauth-mcp/register. Redirect URIs must be https, a loopback http address, or a native-app custom scheme. Each IP address can register up to 10 clients per hour.
    • Authorization code flow at /api/oauth-mcp/authorize with PKCE; only S256 is accepted. Clients are public: the token endpoint, /api/oauth-mcp/token, takes no client secret.
    • Scopes are APROS permission names, such as VIEW_LEAD.
    • Access tokens are valid for 30 days. Refresh tokens rotate: each one works once and is replaced by a new one.

Webhooks

Previous Page

Booking API

Next Page