---
url: /relyagent-whmcs/features/connections-oauth.md
description: >-
  Every AI client connects through an admin-provisioned connection with its own
  secret, an OAuth 2.0 + PKCE flow, your native WHMCS admin login and a consent
  screen — no self-registration.
---

# Connections & OAuth

A **connection** is how one AI client is linked to your WHMCS. You create connections yourself
under **Addons → Relyagent → MCP Clients** — there is **no open self-registration**. An AI client
can only connect with a **Client ID** and **Client Secret** that you issue, so nobody adds
themselves.

"MCP" here means the **Model Context Protocol** — the open standard that lets AI assistants call
the WHMCS tools you expose. OAuth is the sign-in and authorisation layer that keeps those
connections safe.

![MCP Clients list with connections](/relyagent-whmcs/img/relyagent-connections-oauth-clients.png)
*Addons → Relyagent → MCP Clients*

## Creating a connection

On **New connection** you give it a name (for example *"Claude — Production"*) and tick exactly
the **Allowed tools** it may use — only ticked tools are listable and callable, and OAuth scopes
are [derived from them automatically](/relyagent-whmcs/features/mcp-tools). On save, Relyagent
issues an OAuth **Client ID** and **Client Secret**. The secret is shown **once**, so copy it
straight away. You then paste the **Endpoint URL**, Client ID and Client Secret into the AI
client's custom-connector settings.

The **Endpoint URL** is persistent and the same for every connection, with a Copy button:

```
https://<your-whmcs>/modules/addons/relyagent/public/mcp/endpoint.php
```

## The OAuth flow, in plain English

Once the AI client has the Endpoint URL, Client ID and Client Secret, connecting runs an
**OAuth 2.0 authorization-code flow with PKCE**. In practice:

1. **Discover endpoints** — the client reads the Endpoint URL and auto-discovers where to
   authorize and get tokens. You don't configure any of this by hand.
2. **Token endpoint needs the secret** — getting a token requires the **connection's secret**,
   so admin credentials alone are never enough to connect.
3. **Native WHMCS admin login** — you're sent to your **own WHMCS admin login**. Relyagent shows
   no login form of its own, so your existing 2FA, brute-force protection and IP rules all apply.
4. **Consent screen** — a screen lists the connection's tools; you approve it to finish.

From then on the client sees only that connection's tools, and any other tool call is rejected.

![Consent screen listing a connection's tools](/relyagent-whmcs/img/relyagent-connections-oauth-consent.png)
*Consent screen shown after the WHMCS admin login*

## Changing a connection safely

Editing which tools a connection may use follows a **secure edit model** so a change can never
silently widen access:

* **Removing** a tool applies **immediately** — the client loses it right away.
* **Adding** a tool requires the client to **reconnect and re-consent**. Adding revokes the
  existing tokens, so the extra access only takes effect after a fresh sign-in and consent.

::: info Why reconnect on add?
Consent is tied to the exact tools a client was granted. Requiring a fresh consent when access
grows means an AI client can never gain new abilities without you signing in and approving them.
:::

## Regenerate secret and revoke

Each connection has its own actions:

* **Regenerate secret** — issues a new Client Secret. The current one **stops working
  immediately** and the client must reconnect with the new secret. Use this if a secret may have
  leaked.
* **Revoke** — removes the connection entirely so it can no longer connect.

::: tip
For step-by-step setup of a specific AI client, use the connection guides — start with
[Claude Desktop](/relyagent-whmcs/guides/claude-desktop). To review what each connection actually
did, see the [Audit Log](/relyagent-whmcs/features/audit-and-rate-limits).
:::