Connections & OAuth

A connection is how one AI client is linked to your WHMCS. You create connections yourself under Addons → Relyagent → MCP Clients — there is no open self-registration. An AI client can only connect with a Client ID and Client Secret that you issue, so nobody adds themselves.

"MCP" here means the Model Context Protocol — the open standard that lets AI assistants call the WHMCS tools you expose. OAuth is the sign-in and authorisation layer that keeps those connections safe.

Addons → Relyagent → MCP Clients

Creating a connection

On New connection you give it a name (for example "Claude — Production") and tick exactly the Allowed tools it may use — only ticked tools are listable and callable, and OAuth scopes are derived from them automatically. On save, Relyagent issues an OAuth Client ID and Client Secret. The secret is shown once, so copy it straight away. You then paste the Endpoint URL, Client ID and Client Secret into the AI client's custom-connector settings.

The Endpoint URL is persistent and the same for every connection, with a Copy button:

https://<your-whmcs>/modules/addons/relyagent/public/mcp/endpoint.php

The OAuth flow, in plain English

Once the AI client has the Endpoint URL, Client ID and Client Secret, connecting runs an OAuth 2.0 authorization-code flow with PKCE. In practice:

1. Discover endpoints — the client reads the Endpoint URL and auto-discovers where to authorize and get tokens. You don't configure any of this by hand.
2. Token endpoint needs the secret — getting a token requires the connection's secret, so admin credentials alone are never enough to connect.
3. Native WHMCS admin login — you're sent to your own WHMCS admin login. Relyagent shows no login form of its own, so your existing 2FA, brute-force protection and IP rules all apply.
4. Consent screen — a screen lists the connection's tools; you approve it to finish.

From then on the client sees only that connection's tools, and any other tool call is rejected.

Consent screen shown after the WHMCS admin login

Changing a connection safely

Editing which tools a connection may use follows a secure edit model so a change can never silently widen access:

• Removing a tool applies immediately — the client loses it right away.
• Adding a tool requires the client to reconnect and re-consent. Adding revokes the existing tokens, so the extra access only takes effect after a fresh sign-in and consent.

Why reconnect on add?

Consent is tied to the exact tools a client was granted. Requiring a fresh consent when access grows means an AI client can never gain new abilities without you signing in and approving them.

Regenerate secret and revoke

Each connection has its own actions:

• Regenerate secret — issues a new Client Secret. The current one stops working immediately and the client must reconnect with the new secret. Use this if a secret may have leaked.
• Revoke — removes the connection entirely so it can no longer connect.

TIP

For step-by-step setup of a specific AI client, use the connection guides — start with Claude Desktop. To review what each connection actually did, see the Audit Log.