Connect Claude, Cursor, Cline, OpenClaw and any MCP-compatible client directly to your workspace. One URL, automatic OAuth, full access to pages, databases, tasks and meetings.
Reading this as an agent? Get raw markdown at /for-agenter.md or the index at /llms.txt.
Paste the URL into your MCP client. The OAuth flow is handled automatically.
Official skill for OpenClaw — auto-configures transport and OAuth.
OpenClaw CLI
openclaw skills install zecurecode/workosmcpClawHub CLI
npx clawhub@latest install workosmcpThe skill teaches the agent when to use WorkOS, documents all ~60 tools and sets the Streamable HTTP transport correctly. If your MCP client is not OpenClaw, set it up manually with the instructions below.
Examples for the most common MCP clients. They all use the same URL and the same OAuth flow.
Add as a remote MCP server. The OAuth flow opens in the browser the first time and is then stored automatically.
{
"mcpServers": {
"workos": {
"url": "https://workos.no/api/mcp"
}
}
}Claude Desktop: put this in claude_desktop_config.json. Claude.ai (web): Settings → Connectors → Add custom connector → paste the URL.
Cursor supports remote MCP servers via Streamable HTTP with automatic OAuth.
{
"mcpServers": {
"workos": {
"url": "https://workos.no/api/mcp"
}
}
}Settings → MCP → Add new MCP server, or paste in ~/.cursor/mcp.json.
Cline must explicitly use Streamable HTTP — not SSE. The server is stateless and returns 405 for GET.
{
"mcpServers": {
"workos": {
"type": "streamableHttp",
"url": "https://workos.no/api/mcp"
}
}
}Set type to "streamableHttp". Older SSE configurations will fail — see Troubleshooting below.
Install the official ClawHub skill. It sets URL, transport and OAuth automatically and teaches the agent when WorkOS should be used.
openclaw skills install zecurecode/workosmcpOr manually: openclaw mcp add workos --url https://workos.no/api/mcp.
For those building their own MCP client or wanting to understand what's happening under the hood.
Authorizationheader. Access token: 1 hour. Refresh token: 30 days.The most common reasons an MCP client fails to connect.
Most common with older Cline versions. WorkOS uses Streamable HTTP (POST), not SSE. Set "type": "streamableHttp" in the configuration, or upgrade the client.
The client must be able to open a browser to complete consent. On remote machines without a browser, copy the authorization URL manually and paste it into a local browser.
Access tokens expire after 60 minutes. MCP clients should automatically refresh via the refresh token. If not, remove the server and add it again to start a new OAuth flow.
The token is tied to one workspace. To switch: remove the server in the client, sign in with the right account in the browser, and add the server again.
You need a WorkOS account for the agent to authenticate. Takes less than a minute to create.