MCP authentication
Claude signs in to FlowState with your own FlowState account, the same account and permissions you use in the web app. You sign in with email and password or with Google, on the FlowState sign-in page. FlowState never gives Claude your password.
Who can use MCP
Two conditions apply:
- The feature is on. An owner or admin turns on MCP server under Settings → Features. It is off for a new tenant.
- Your role allows it. The owner, admin and member roles can use MCP. The viewer role cannot, and cannot list the tools either. Owners and admins also need multi-factor authentication: an authenticator app set up on their FlowState account, or a sign-in with a Google Workspace account.
Each tool also checks its own permission, so a member cannot call an owner-only tool. The Tool catalog shows the permission for each tool.
Sign-in
- When you connect FlowState in Claude, Claude opens the FlowState sign-in page in your browser.
- You sign in with email and password, or with Google.
- FlowState returns you to Claude, and Claude stores the sign-in.
Claude sends that sign-in with every tool call. FlowState checks it on every call.
How long a sign-in lasts
| Item | Lifetime | What happens then |
|---|---|---|
| Access token | 60 minutes | Claude renews it automatically. |
| Sign-in (refresh token) | 30 days from when you signed in | You sign in again. |
Which tenant Claude works in
Claude always works in the tenant of your sign-in. No tool takes a tenant as a parameter, so Claude cannot reach another tenant.
- You belong to one tenant: Claude works in that tenant.
- You belong to more than one tenant: Claude works in your default workspace for
Claude. Choose it in the FlowState app under Settings → MCP, in the
Default workspace for Claude card, or ask Claude to run
set_my_mcp_default_tenant(target_tenant_id). You can choose only a tenant you are an active member of. The choice applies from the connector’s next access token: Claude renews it within 60 minutes. To apply it at once, reconnect FlowState under Customize → Connectors in Claude.
If you have more than one tenant and no default workspace, or you are no longer an active member of the one you chose, the sign-in has no tenant. Claude then reports that the connection is not scoped to a FlowState workspace. Choose a default workspace, then reconnect FlowState.
select_active_tenant does not switch tenants over MCP: it returns NOT_SUPPORTED.
To see which tenant your sign-in uses, ask Claude to run get_my_profile().
Errors
When access is refused, the request stops with HTTP 403 and one of these errors:
| Code | Message | Cause and fix |
|---|---|---|
-32031 | Missing permission: tenant:mcp:invoke | Your role is viewer, or you are an owner or admin without multi-factor authentication. Ask an admin to change your role, or set up an authenticator app. |
-32030 | MCP access is disabled for this tenant | The MCP server feature is off. An owner or admin turns it on under Settings → Features. |