--- url: /relyagent-whmcs/configuration.md description: >- Create your first Relyagent connection in WHMCS, pick its tools, hand the AI client its Client ID, Client Secret and Endpoint URL, then authorize through your WHMCS admin login and consent — plus the secure edit model and global MCP caps. --- # Configuration This page walks you end to end: create a **connection** in WHMCS, pick the exact tools it may use, and connect an AI client to it. A connection is an admin-provisioned link to one AI client, limited to the tools you tick and secured with its own OAuth credentials. ::: info What is MCP? The **Model Context Protocol (MCP)** is an open standard that lets AI assistants call external tools. Relyagent makes your WHMCS one of those tool providers — so a client like Claude can list and call only the WHMCS tools you allow. ::: Before you start, make sure connections are enabled globally: open **Addons → Relyagent → Settings → MCP Settings → AI Client Connections** and turn on **Allow AI clients to connect**. See [global caps](#global-mcp-settings-caps) below. ## Create a connection Open **Addons → Relyagent → MCP Clients**. Near the top you'll find the persistent **Endpoint URL** with a **Copy** button — it's the same for every connection: ``` https:///modules/addons/relyagent/public/mcp/endpoint.php ``` ![New connection form on the MCP Clients tab](/relyagent-whmcs/img/relyagent-configuration-new-connection.png) *Addons → Relyagent → MCP Clients* 1. Click **New connection** and give it a clear **name** — the placeholder suggests something like *"Claude — Production"* so you can tell connections apart later. 2. Tick the exact **Allowed tools** this connection may use. As the on-screen help puts it: *"Tick exactly the tools this connection may use — only ticked tools are listable and callable, and OAuth scopes are derived from them automatically. Click a group to expand it."* 3. **Scopes are derived automatically** from the tools you tick — you never hand-edit scopes. A `:read` scope appears when you tick a read tool in that group, and `:write` when you tick a write tool. 4. State-changing tools show a red **dangerous** badge; a tool whose group is switched off shows *"group off — won't run"* so you know it won't do anything even if ticked. ::: tip Start read-only Tick only the read tools you actually need for the first connection. You can always edit it later — see the [secure edit model](#the-secure-edit-model). ::: ## Credentials Relyagent issues When you save, Relyagent issues this connection its own OAuth credentials: * **Client ID** — identifies the connection. * **Client Secret** — shown **once**, right after you create the connection. Copy it now and store it somewhere safe; you can't view it again. * **Endpoint URL** — the shared MCP address above. ::: warning The secret is shown only once If you lose the secret, you can't recover it — use **Regenerate secret** to issue a new one (which forces the client to reconnect). Never paste a secret into a page you don't trust. ::: You hand these three values to the AI client. There is **no open self-registration**: a client can only connect with a Client ID and Client Secret you issue. ## Connect the AI client In the AI client's custom-connector settings, paste the **Endpoint URL**, **Client ID** and **Client Secret**, then let it connect: 1. The client auto-discovers Relyagent's OAuth endpoints and starts the sign-in. 2. You're sent to your **native WHMCS admin login** — Relyagent shows no login form of its own, so your existing 2FA, brute-force and IP rules all still apply. 3. A **consent screen** lists this connection's tools. Approve it to finish. 4. From then on the client sees only that connection's tools when it lists them, and any other tool call is rejected. ![Consent screen listing a connection's tools](/relyagent-whmcs/img/relyagent-configuration-consent.png) *Addons → Relyagent → MCP Clients (consent shown after admin login)* For step-by-step instructions per client, see the guides: [Claude Desktop](/relyagent-whmcs/guides/claude-desktop), [Claude.ai](/relyagent-whmcs/guides/claude-ai), [Claude Code](/relyagent-whmcs/guides/claude-code), [Cursor](/relyagent-whmcs/guides/cursor) and [ChatGPT](/relyagent-whmcs/guides/chatgpt). The **Setup** tab in WHMCS has the same steps with your Endpoint URL pre-filled. ## The secure edit model Use **Edit** on a connection to change its ticked tools. Changes apply differently depending on direction, and this is by design so tightening access is instant: * **Removing** a tool applies **immediately** — the client can no longer list or call it. * **Adding** a tool requires the client to **reconnect and re-consent**. Adding revokes the connection's existing tokens, so the operator on the client side signs in again and approves the new consent screen before the added tool becomes usable. ::: tip Why the difference? Removing access should never wait, so it's immediate. Adding access means granting a new tool, so it goes back through the consent screen — nobody gains a tool without an explicit re-approval. ::: ## Regenerate a secret Use **Regenerate secret** when a secret may be exposed or you're rotating credentials. You'll be asked to confirm: *"Generate a new secret? The current secret stops working immediately and the client must reconnect with the new one."* After regenerating, paste the new secret into the AI client and reconnect. ## Revoke a connection Use **Revoke** to shut a connection down entirely. The client can no longer connect or call any tool. Revoke when a connection is no longer needed or you suspect its credentials are compromised. ## Global MCP Settings caps {#global-mcp-settings-caps} Per-connection tool selections always sit **underneath** the global caps in **Addons → Relyagent → Settings → MCP Settings**. Even a ticked tool won't run if a global cap blocks it: * **Allow AI clients to connect** — the master switch. Off means no connection can connect. * **Allowed Scopes** — the ceiling on what any connection may be granted (read-only by default; enable write scopes deliberately). * **Tool-group toggles** — enable/disable each of the 10 groups; a disabled group's tools never list or run, whatever a connection has ticked. * **Dangerous Operations** — off by default. State-changing tools only run when this is on **and** the tool is ticked on the connection. * **Rate limits** — **Calls / minute** (default 60) and **Calls / day** (default 5000), per token. ![MCP Settings global caps](/relyagent-whmcs/img/relyagent-configuration-mcp-settings.png) *Addons → Relyagent → Settings → MCP Settings* ## Where to go next * [MCP tools](/relyagent-whmcs/features/mcp-tools) — the 10 groups and the dangerous-op gate * [Connections & OAuth](/relyagent-whmcs/features/connections-oauth) — how the sign-in flow works * [Settings reference](/relyagent-whmcs/settings) — every setting and its default * Per-client guides: [Claude Desktop](/relyagent-whmcs/guides/claude-desktop) · [Claude.ai](/relyagent-whmcs/guides/claude-ai) · [Claude Code](/relyagent-whmcs/guides/claude-code) · [Cursor](/relyagent-whmcs/guides/cursor) · [ChatGPT](/relyagent-whmcs/guides/chatgpt) * Back to the [overview](/relyagent-whmcs/)