> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moda.app/llms.txt
> Use this file to discover all available pages before exploring further.
# Enterprise Managed Auth
> How an organization admin configures the Moda connector for their whole workspace — OAuth settings, what each member signs in with, and how access is scoped and removed.
This page is for the administrator turning Moda on for an organization once, so every member can use it.
If you are adding Moda to your own account, use the [MCP Connector](/agents/mcp-connector) setup instead — this page
is the same connector, seen from the admin console.
**There is no shared credential to distribute.** Managed auth here means you approve the connector centrally and
each member then authenticates as themselves. Moda mints one grant per person, so a member only ever reaches the
workspaces, canvases, and credits their own Moda account already has. Nothing is pooled behind a service account,
and nothing you configure grants one member access to another's work.
## What you need to enter
Most admin consoles ask for two things. These are the answers:
| Field | Value |
| ------------------------- | --------------------------------------------------------------- |
| Remote MCP server URL | `https://agents.moda.app/mcp` |
| Authentication | OAuth 2.1 — authorization code with PKCE |
| Client ID / client secret | **Leave blank.** Moda registers clients dynamically (RFC 7591). |
| Scopes | `openid profile email offline_access` |
Everything else is discoverable. Your host reads the authorization-server metadata at
`/.well-known/oauth-authorization-server` and configures itself, which is why the credential fields stay empty.
## Before you start
* **You need to be an owner.** Adding a connector for an organization is an owner-level action in Claude
(**Organization settings → Connectors**) and in most other hosts. Members cannot self-serve an org connector.
* **Members do not need a Moda account first.** The first time someone connects, a verified identity with no Moda
account is given one automatically. You do not have to pre-provision, invite, or seat anybody ahead of the rollout.
* **Entitlements are the account's, not the connector's.** Plan tier, credits, brand kits, and canvases are identical
whether a member reaches Moda through this connector, the [CLI](/agents/cli-quickstart), or the web app. Approving
the connector does not change anyone's plan or spend limits.
## Add the connector
In Claude, go to **Settings → Organization settings → Connectors** as an Owner. Other hosts put this under an
admin, workspace, or enterprise section — you are looking for the place that adds a *custom remote MCP server*
for everyone, not the personal connector list.
Name it `Moda` and paste the connector URL:
```
https://agents.moda.app/mcp
```
If the form shows optional **Client ID** and **Client secret** fields, skip them. Moda supports dynamic client
registration, so your host mints its own client on first use. Filling these in with values from somewhere else
will break the connection rather than harden it.
If your console *requires* a client ID and secret, see [Registering a client by
hand](#registering-a-client-by-hand) below.
Save and make it available to members. Depending on the host this is a visibility toggle, an approval, or an
assignment to specific groups. Nobody is signed in yet — you have made Moda *available*, not connected.
Before you announce it, connect once yourself. You should get a Moda sign-in page, a consent screen, and — if
your Moda account belongs to more than one workspace — a workspace picker. Then the Moda tools appear in a
conversation. That full loop is the real test that the org configuration is right.
## What each member does
After you have published it, a member's path is short:
They turn Moda on for the conversation from the connectors or tools menu.
A Moda sign-in opens in their browser and they approve the scopes. Tokens are held by the host — the model never
sees a credential, and neither do you.
If their Moda account belongs to more than one workspace, Moda asks which one the connection should act in. One
workspace and the step is skipped. Their agent can still act in another of their teams on an individual call;
changing the *default* means disconnecting and reconnecting.
Each member holds their own grant. Rolling the connector out to a hundred people creates a hundred independent
authorizations, and revoking one leaves the rest untouched.
## OAuth reference
Every value below is served live at the
[authorization-server metadata document](https://agents.moda.app/.well-known/oauth-authorization-server). Read it from
there rather than copying by hand where your tooling allows it. Endpoint paths are relative to the issuer.
Copy the issuer exactly as written, trailing slash and all — that is the string the metadata document advertises, and
OpenID Connect clients compare it byte-for-byte. Dropping the slash to tidy it up is a common cause of a client
rejecting an otherwise valid token.
| Property | Value |
| -------------------------------------- | ---------------------------------------------------- |
| Issuer | `https://agents.moda.app/` (trailing slash included) |
| Authorization endpoint | `/authorize` |
| Token endpoint | `/token` |
| Registration endpoint (RFC 7591) | `/register` |
| Protected-resource metadata (RFC 9728) | `/.well-known/oauth-protected-resource/mcp` |
| Grant types | `authorization_code`, `refresh_token` |
| Response types | `code` |
| PKCE | `S256` — required |
| Token endpoint auth methods | `client_secret_post`, `client_secret_basic` |
| Scopes | `openid`, `profile`, `email`, `offline_access` |
The scopes are identity and session scopes: they establish *who* the member is and let the host refresh without
sending them back through sign-in. What that person can then do inside Moda is decided by their own Moda account and
workspace membership, not by anything in the token.
### Registering a client by hand
Some consoles insist on a client ID and secret and will not accept an empty pair. Moda's registration endpoint is
open, so you can mint one:
```bash theme={null}
curl -X POST https://agents.moda.app/register \
-H "Content-Type: application/json" \
-d '{
"client_name": "Acme Corp — Claude",
"redirect_uris": ["https://claude.ai/api/mcp/auth_callback"],
"grant_types": ["authorization_code", "refresh_token"],
"response_types": ["code"],
"token_endpoint_auth_method": "client_secret_post"
}'
```
The response contains `client_id` and `client_secret`. Paste those into the console.
Use your host's real callback URL in `redirect_uris` — the value above is Claude's. Moda does not enforce a
redirect-URI allowlist, so a wrong value here will not be rejected at sign-in; it is simply the address the proxy
falls back to when a host omits `redirect_uri` on the authorization request. Getting it right keeps that fallback
correct. (PKCE, the consent screen, and per-user scoped tokens are what defend the flow, rather than a registered-URI
check that a motivated attacker could satisfy with any free HTTPS host.)
Treat `client_secret` as a credential: store it in your secret manager, not a ticket or a shared doc. It identifies
the *host application*, not any person, so it grants nothing on its own — but it belongs with your other OAuth
secrets. To rotate, register a fresh client and update the console; the old one simply stops being used.
## What the connector can reach
Worth knowing before you sign off on it:
* **It never touches a member's machine.** The connector runs in the host's cloud and talks to Moda's servers. No
tool takes a file path; there is no access to local folders, repositories, or drives. Content is passed inline and
results come back as links.
* **It cannot cross between members.** Each grant resolves to one Moda account. A member reaches the organizations
and canvases their account already has, and nothing else.
* **It is the same service as everything else.** The connector is a transport, not a separate data plane. Anything a
member could already do in Moda's web app, they can do here; anything they could not, they still cannot.
For the tool list and per-tool detail, see [MCP Connector](/agents/mcp-connector).
## Removing access
| Goal | What to do |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Turn Moda off for the whole org | Remove or unpublish the connector in your admin console. Members lose the tools at once. |
| Turn it off for one person | Have them remove the connector from their own account, or remove their access in the host if it supports per-member assignment. |
| Offboard someone entirely | Remove their Moda account. Their grant stops resolving to an identity and every tool call fails with a non-retryable `account_not_found`. |
Moda's authorization server does not advertise an OAuth revocation endpoint, so revoking a *single live token* out of
band is not a lever available to you today. Removing the connector and deactivating the account are the two controls
that matter, and both take effect on the member's next call.
## Network
If your organization filters outbound traffic, members' browsers need to reach:
| Host | Why |
| ----------------- | ------------------------------------------------------------------------- |
| `agents.moda.app` | The MCP endpoint, the OAuth flow, and the workspace picker. |
| `clerk.moda.app` | The identity provider behind Moda sign-in — reached during the OAuth hop. |
| `*.moda.app` | Canvas editor links and export downloads returned by tools. |
The host's own servers make the MCP calls to `agents.moda.app`; nothing needs to be opened inbound on your side.
## Troubleshooting
| Symptom | Cause and fix |
| -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Members do not see Moda in the tools menu | The connector is added but not published to them. Check its visibility or group assignment in the admin console. |
| Sign-in completes, then the connection fails | Moda could not link an account to that identity. The member sees a page saying which: an unverified or missing email address, an address already owned by another Moda account, or an account still inside its deletion recovery window. Resolve that and reconnect. |
| Tools return "not authenticated" for one member | That member's grant is stale. Have them remove and re-add the connector — the grant is tied to the connector URL. |
| Everyone sees `start_design_task` and similar tool names | They are on the [legacy MCP server](/mcp/overview), not this connector. Re-add using the URL above. |
| A member connects but lands in the wrong workspace | The workspace is bound at connect time. Disconnect and reconnect to choose a different default. |
Something not covered here? [support@moda.app](mailto:support@moda.app).