Enterprise Managed Auth

This page is for the administrator turning Moda on for an organization once, so every member can use it. If you are adding Moda to your own account, use the MCP Connector setup instead — this page is the same connector, seen from the admin console.

There is no shared credential to distribute. Managed auth here means you approve the connector centrally and each member then authenticates as themselves. Moda mints one grant per person, so a member only ever reaches the workspaces, canvases, and credits their own Moda account already has. Nothing is pooled behind a service account, and nothing you configure grants one member access to another’s work.

What you need to enter

Most admin consoles ask for two things. These are the answers:

Field	Value
Remote MCP server URL	`https://agents.moda.app/mcp`
Authentication	OAuth 2.1 — authorization code with PKCE
Client ID / client secret	Leave blank. Moda registers clients dynamically (RFC 7591).
Scopes	`openid profile email offline_access`

Everything else is discoverable. Your host reads the authorization-server metadata at /.well-known/oauth-authorization-server and configures itself, which is why the credential fields stay empty.

Before you start

You need to be an owner. Adding a connector for an organization is an owner-level action in Claude (Organization settings → Connectors) and in most other hosts. Members cannot self-serve an org connector.
Members do not need a Moda account first. The first time someone connects, a verified identity with no Moda account is given one automatically. You do not have to pre-provision, invite, or seat anybody ahead of the rollout.
Entitlements are the account’s, not the connector’s. Plan tier, credits, brand kits, and canvases are identical whether a member reaches Moda through this connector, the CLI, or the web app. Approving the connector does not change anyone’s plan or spend limits.

Add the connector

Open your organization's connector settings

In Claude, go to Settings → Organization settings → Connectors as an Owner. Other hosts put this under an admin, workspace, or enterprise section — you are looking for the place that adds a custom remote MCP server for everyone, not the personal connector list.

Add Moda as a custom connector

Name it Moda and paste the connector URL:

https://agents.moda.app/mcp

Leave the OAuth credential fields empty

If the form shows optional Client ID and Client secret fields, skip them. Moda supports dynamic client registration, so your host mints its own client on first use. Filling these in with values from somewhere else will break the connection rather than harden it.If your console requires a client ID and secret, see Registering a client by hand below.

Publish it to the organization

Save and make it available to members. Depending on the host this is a visibility toggle, an approval, or an assignment to specific groups. Nobody is signed in yet — you have made Moda available, not connected.

Have one member connect end to end

Before you announce it, connect once yourself. You should get a Moda sign-in page, a consent screen, and — if your Moda account belongs to more than one workspace — a workspace picker. Then the Moda tools appear in a conversation. That full loop is the real test that the org configuration is right.

What each member does

After you have published it, a member’s path is short:

Enable Moda

They turn Moda on for the conversation from the connectors or tools menu.

A Moda sign-in opens in their browser and they approve the scopes. Tokens are held by the host — the model never sees a credential, and neither do you.

Choose a workspace

If their Moda account belongs to more than one workspace, Moda asks which one the connection should act in. One workspace and the step is skipped. Their agent can still act in another of their teams on an individual call; changing the default means disconnecting and reconnecting.

Each member holds their own grant. Rolling the connector out to a hundred people creates a hundred independent authorizations, and revoking one leaves the rest untouched.

OAuth reference

Every value below is served live at the authorization-server metadata document. Read it from there rather than copying by hand where your tooling allows it. Endpoint paths are relative to the issuer. Copy the issuer exactly as written, trailing slash and all — that is the string the metadata document advertises, and OpenID Connect clients compare it byte-for-byte. Dropping the slash to tidy it up is a common cause of a client rejecting an otherwise valid token.

Property	Value
Issuer	`https://agents.moda.app/` (trailing slash included)
Authorization endpoint	`/authorize`
Token endpoint	`/token`
Registration endpoint (RFC 7591)	`/register`
Protected-resource metadata (RFC 9728)	`/.well-known/oauth-protected-resource/mcp`
Grant types	`authorization_code`, `refresh_token`
Response types	`code`
PKCE	`S256` — required
Token endpoint auth methods	`client_secret_post`, `client_secret_basic`
Scopes	`openid`, `profile`, `email`, `offline_access`

The scopes are identity and session scopes: they establish who the member is and let the host refresh without sending them back through sign-in. What that person can then do inside Moda is decided by their own Moda account and workspace membership, not by anything in the token.

Registering a client by hand

Some consoles insist on a client ID and secret and will not accept an empty pair. Moda’s registration endpoint is open, so you can mint one:

curl -X POST https://agents.moda.app/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Acme Corp — Claude",
    "redirect_uris": ["https://claude.ai/api/mcp/auth_callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "client_secret_post"
  }'

The response contains client_id and client_secret. Paste those into the console. Use your host’s real callback URL in redirect_uris — the value above is Claude’s. Moda does not enforce a redirect-URI allowlist, so a wrong value here will not be rejected at sign-in; it is simply the address the proxy falls back to when a host omits redirect_uri on the authorization request. Getting it right keeps that fallback correct. (PKCE, the consent screen, and per-user scoped tokens are what defend the flow, rather than a registered-URI check that a motivated attacker could satisfy with any free HTTPS host.)

Treat client_secret as a credential: store it in your secret manager, not a ticket or a shared doc. It identifies the host application, not any person, so it grants nothing on its own — but it belongs with your other OAuth secrets. To rotate, register a fresh client and update the console; the old one simply stops being used.

What the connector can reach

Worth knowing before you sign off on it:

It never touches a member’s machine. The connector runs in the host’s cloud and talks to Moda’s servers. No tool takes a file path; there is no access to local folders, repositories, or drives. Content is passed inline and results come back as links.
It cannot cross between members. Each grant resolves to one Moda account. A member reaches the organizations and canvases their account already has, and nothing else.
It is the same service as everything else. The connector is a transport, not a separate data plane. Anything a member could already do in Moda’s web app, they can do here; anything they could not, they still cannot.

For the tool list and per-tool detail, see MCP Connector.

Removing access

Goal	What to do
Turn Moda off for the whole org	Remove or unpublish the connector in your admin console. Members lose the tools at once.
Turn it off for one person	Have them remove the connector from their own account, or remove their access in the host if it supports per-member assignment.
Offboard someone entirely	Remove their Moda account. Their grant stops resolving to an identity and every tool call fails with a non-retryable `account_not_found`.

Moda’s authorization server does not advertise an OAuth revocation endpoint, so revoking a single live token out of band is not a lever available to you today. Removing the connector and deactivating the account are the two controls that matter, and both take effect on the member’s next call.

Network

If your organization filters outbound traffic, members’ browsers need to reach:

Host	Why
`agents.moda.app`	The MCP endpoint, the OAuth flow, and the workspace picker.
`clerk.moda.app`	The identity provider behind Moda sign-in — reached during the OAuth hop.
`*.moda.app`	Canvas editor links and export downloads returned by tools.

The host’s own servers make the MCP calls to agents.moda.app; nothing needs to be opened inbound on your side.

Troubleshooting

Symptom	Cause and fix
Members do not see Moda in the tools menu	The connector is added but not published to them. Check its visibility or group assignment in the admin console.
Sign-in completes, then the connection fails	Moda could not link an account to that identity. The member sees a page saying which: an unverified or missing email address, an address already owned by another Moda account, or an account still inside its deletion recovery window. Resolve that and reconnect.
Tools return “not authenticated” for one member	That member’s grant is stale. Have them remove and re-add the connector — the grant is tied to the connector URL.
Everyone sees `start_design_task` and similar tool names	They are on the legacy MCP server, not this connector. Re-add using the URL above.
A member connects but lands in the wrong workspace	The workspace is bound at connect time. Disconnect and reconnect to choose a different default.

Something not covered here? support@moda.app.

Start here

Chat hosts

Teaching your agent

Enterprise Managed Auth

What you need to enter

Before you start

Add the connector

What each member does

OAuth reference

Registering a client by hand

What the connector can reach

Removing access

Network

Troubleshooting

​What you need to enter

​Before you start

​Add the connector

​What each member does

​OAuth reference

​Registering a client by hand

​What the connector can reach

​Removing access

​Network

​Troubleshooting

What you need to enter

Before you start

Add the connector

What each member does

OAuth reference

Registering a client by hand

What the connector can reach

Removing access

Network

Troubleshooting