Connecting to Claude
SZ-MCP is added to Claude as a custom connector. There is one URL, the same for everybody, and the OAuth token Claude obtains is what binds it to your account.
Add the connector
Section titled “Add the connector”-
Copy the MCP URL from your dashboard:
https://sz-mcp.lanpulse.com/mcp/ -
In Claude, open Settings → Connectors → Add custom connector.
-
Paste the URL and give it a name — “SmartZone”, or anything you like.
-
Claude opens a sign-in and consent page. Sign in with the same Google account you used on the dashboard.
-
The consent screen names the client requesting access, the site access is handed to, and the account it will act as, and lists what it may do. If you belong to more than one organisation, pick one under Organisation — the connector uses that organisation’s controller; add the connector again to use another. Choose Allow.
Save your credentials on the dashboard before connecting. The connector will
register and authorize either way, but every call returns no_credentials
until a controller is saved.
What the consent screen grants
Section titled “What the consent screen grants”The screen lists two things:
- Call the SmartZone WSG and SwitchM APIs on your behalf using the organisation’s stored credentials
- Search and read the SmartZone OpenAPI specs
There is a single scope, sz:call. The connector cannot see your password and
cannot act for any other account. It is tied to the one organisation you chose,
and what it may do follows your role there: viewers and operators cannot send
writes. It can read some of that organisation’s SZ-MCP setup, such as the
notification channels and the exported organisation bundle, but not secrets.
If this is your first authorization, the screen also asks you to accept the Terms of Service and Privacy Policy. Submitting without ticking the box returns you to the same screen with “Please accept the Terms and Privacy Policy to continue.”
How the connection is authenticated
Section titled “How the connection is authenticated”SZ-MCP implements OAuth 2.1 with Dynamic Client Registration (RFC 7591) and PKCE, which is what lets Claude connect without you creating an app registration by hand.
-
Claude registers itself as a client, receiving a generated
client_id. -
Claude sends you to the authorize endpoint with a PKCE challenge.
-
Your Google session identifies you; Allow issues a short-lived authorization code.
-
Claude exchanges the code — proving possession of the PKCE verifier — for an access token and a refresh token.
PKCE is mandatory, and the S256 challenge method is the only one accepted. An
authorization request without a challenge is rejected with code_challenge required (PKCE).
Token lifetimes
Section titled “Token lifetimes”| Token | Lifetime | Notes |
|---|---|---|
| Authorization code | 10 minutes | Single use |
| Access token | 30 days | Prefixed szmk_. Stored hashed, never in plaintext |
| Refresh token | 90 days | Rotated on every use — the old one is revoked as the new one is issued |
| Client registration | 30 days | Claude re-registers automatically when it lapses |
Claude refreshes the access token on its own. You do not need to reconnect every 30 days.
Revoking access
Section titled “Revoking access”Revoke one connector on the dashboard under Configure › Claude connector › Connected clients: Revoke ends it at once (its token stops working and it cannot refresh), and Revoke all ends every one. Deleting the SmartZone credentials instead stops every connector in the organisation, because the login belongs to the organisation.
| Goal | Do this |
|---|---|
| Stop one connector at once | Revoke it under Configure › Claude connector › Connected clients |
| Stop Claude reaching SZ-MCP at all | Revoke it there, and remove the connector in Claude → Settings → Connectors |
| Stop every member’s connector reaching the controller | An admin deletes the credentials on Configure › Controller |
| Rotate the controller password | Update it in SmartZone, then save the new one on the dashboard — no reconnect needed |
| Move to a different controller | Save the new host and credentials — no reconnect needed |
When the connector misbehaves
Section titled “When the connector misbehaves”If Claude reports the connector as unavailable, or you end up looping through sign-in without landing on the consent screen, see Troubleshooting.