Connect an AI client to Cantemo MCP

Cantemo MCP lets compatible AI clients use selected Cantemo functions as tools. Your administrator must enable Cantemo MCP and grant your Cantemo account access before you can connect.

Before you begin

Ask your administrator for the MCP server URL, for example https://cantemo.example.com/mcp. Then choose one authentication method:

  • OAuth login: ask for the OAuth client ID assigned to your AI client.

  • API token: create a personal Cantemo API token or ask your administrator to create one for your Cantemo account. Your AI client must support custom HTTP headers for remote MCP servers.

Your AI client must support a remote Streamable HTTP MCP server. OAuth login also requires authorization-code login with PKCE S256.

Connect with OAuth

Add a remote MCP server in your AI client’s MCP settings using the details from your administrator. For OAuth login, use values equivalent to these:

Server name: Cantemo
Server URL: https://cantemo.example.com/mcp
Transport: Streamable HTTP
Authentication: OAuth authorization code with PKCE S256
OAuth client ID: <client ID supplied by your administrator>
Callback URL: http://localhost:37195/callback

Save the configuration, enable the server if required, and choose the client’s sign-in action. Complete the sign-in in your browser with the account that you use for Cantemo. The client manages the OAuth access token; do not add an Authorization or Auth-Token header manually.

The callback URL is the address where the identity provider sends your browser after you sign in. If your AI client asks for a callback URL, use the default callback URL above. If sign-in reports an invalid callback URL, contact your administrator to confirm that this URL is registered.

Connect with an API token

API-token authentication is an alternative to OAuth login. It connects as the Cantemo user assigned to the token, so the available tools and their access are limited by that user’s Cantemo permissions.

To create a token for yourself, send a POST request to Cantemo’s token API with your Cantemo username and password. Replace the example values with your own:

curl --user "<username>:<password>" --request POST \
  "https://cantemo.example.com/API/v2/auth/token/?assignee=<username>&name=Cantemo%20MCP"

The response contains the token in its key field. Record it immediately: Cantemo does not show the complete token again. If your account can only sign in through SSO and you do not have Cantemo password credentials, ask an administrator to create a token for your account.

Configure the token as the Auth-Token custom request header for the MCP server. The exact configuration format depends on the AI client. For clients whose MCP configuration uses a headers object, the equivalent configuration is:

{
  "mcpServers": {
    "cantemo": {
      "url": "https://cantemo.example.com/mcp",
      "headers": {
        "Auth-Token": "<your Cantemo API token>"
      }
    }
  }
}

The client must send this header on every MCP request, including requests for an existing session. Do not configure OAuth login or an Authorization header for this server at the same time. Cantemo rejects requests that contain both Authorization and Auth-Token headers.

Treat an API token like a password. Use your AI client’s secret storage or environment-variable support instead of storing it in a shared configuration file. Revoke the token from Settings > API Tokens when it is no longer needed or if it may have been exposed.

Verify the connection

After signing in, ask the AI client to list the available Cantemo tools. The tools you see depend on the permissions and tool access configured by your administrator. If the whoami_retrieve tool is available, run it to confirm which Cantemo account the connection uses.

Troubleshooting

If the browser sign-in reports an invalid callback URL, give your administrator the default callback URL from the connection settings. If the server cannot be reached, confirm the MCP server URL and that you can access it from your network. If you can sign in but cannot see an expected tool or receive an access error, contact your administrator to check your Cantemo permissions and the MCP tool access configuration.