Connecting an application
Preview
Connected applications are currently available to selected accounts only.
You give the application one URL. It opens the portal in your browser, you sign in there, and a consent screen asks what the application may do. The application never sees your password; it receives an access token for the permissions you allowed.
The endpoints
| URL | Sign-in | Tools |
|---|---|---|
https://mcp.itsh.dev/mcp | Your ITSH account, through the consent screen | Everything your permissions cover |
https://mcp.itsh.dev/mcp/public | None | Domain prices and availability only |
Both use MCP's Streamable HTTP transport. An application that supports remote MCP servers with OAuth finds the sign-in by itself: its first request without a token is answered with 401 and a pointer to where to sign in. The endpoints answer on mcp.itsh.dev only, not on api.itsh.dev.
Claude Code
claude mcp add --transport http itsh https://mcp.itsh.dev/mcpThen run /mcp inside Claude Code, choose itsh and authenticate. Your browser opens the consent screen.
claude.ai and ChatGPT
Both call it a custom connector. Add one in the settings, give it the URL https://mcp.itsh.dev/mcp, and connect it. Connecting opens the consent screen in your browser. Where the settings ask for an authentication type, choose OAuth. Where the option sits depends on your plan and your workspace's settings, so if you cannot find it, look in your provider's help pages for "custom connector".
Who can connect
During the preview only enabled accounts can connect applications, and the consent screen refuses any other account. Only the account holder can approve a connection, signed in to their own session. Approving is refused from any session that acts for someone else: a team member or reseller switched into the account, or ITSH support. It answers:
Only the account holder can make this decision, in their own session. It cannot be done from an impersonated or switched session.
The consent screen
We have not checked this application
Any application can register itself, choose any name and pose as someone else. The screen shows a verified host only where the application proved one. Approve only a connection you started yourself, just now.
| Section | What you decide |
|---|---|
| Application | Nothing: it shows the name the application chose and its verified host, if it has one |
| Permissions | Which of the requested permissions it gets. Clear any you do not want; clearing all of them declines |
| How long | 7, 30 or 90 days, or no expiry. 30 days is preselected |
| Disclosure and third countries | Your consent to data reaching recipients outside the EEA. Required for every third-party application |
| Data processing agreement | Shown only when it applies, see below |
Each permission carries a rating: Read only, Changes data or Critical. Allowing a Critical one, such as deleting mailboxes, needs one more tick confirming that its effects remain after you revoke the access.
There is no spend cap section. It appears only for permissions that buy something, and an application cannot be given any.
Data processing agreement
If your account holds products for which we process personal data on your behalf, such as web hosting or email, the current data processing agreement (DPA) has to be accepted before an application gets access. The consent screen then shows Accept the data processing agreement first with the agreement inline: read it, accept it, then select Allow access again. The request stays open until the time shown on the consent screen. If you have already accepted the current version, the section does not appear.
After you approve
- The application is listed under Account > Connected applications.
- You get an email naming the application and listing its permissions in the consent screen's words. See the emails.
- Connecting the same application again does not add a second connection: your new answer replaces the permissions and expiry of the existing one.
What's next
- Permissions for what to allow
- Managing connections for the activity log and disconnecting