Setup overview
Prerequisites and authentication flow for connecting to the Doow MCP server.
Connect Claude Code, Claude Desktop, Codex, or Cursor to Doow. You’ll register the server, complete the browser-based OAuth flow, and choose the scopes your agent needs before making its first tool call.
Prerequisites
- A Doow account with organization membership
- An MCP client (Claude Code, Codex, Cursor, or any MCP-compatible client)
Your Doow role determines which tools and resources you can access. Admins have full access, while scoped roles (App Admin, Integration Admin, Department Admin) see only their assigned resources.
Authentication flow
The MCP server uses OAuth 2.0 with PKCE, which most MCP clients handle automatically:
- Client registration — Your client registers with Doow's OAuth server
- Authorization — You sign in and grant access to your workspace
- Token exchange — Your client receives an access token
- Tool calls — Every request includes your token for authorization
Using another MCP client? Follow the other clients setup guide. The client must support Streamable HTTP and OAuth 2.0 with PKCE. Protected tools also require interactive MCP elicitation support.
Scopes
Request the scopes your agent needs:
| Scope | Description |
|---|---|
mcp:read | Read-only access to apps, contracts, licenses, cards, team, expenses, integrations, dashboards, insights, and search |
mcp:write | Read and write access to all 85 tools, with confirmation required for protected operations |
Most agents need both scopes. If you only need to query data, request mcp:read alone for a narrower permission set.
What happens after setup
Once connected, your agent can call any tool your permissions allow. A typical first interaction looks like this:
- Ask, “What apps does this organization use?” The client calls
doow_apps_listand returns a list of apps with their status, spend, and users. - Ask, “Show me the contract details for Slack.” The client calls
doow_contracts_getwith the contract ID and returns its terms, renewal date, and spend. - For a protected action, ask, “Freeze the card assigned to the Marketing team for Google Ads.” The client calls
doow_cards_freeze, shows a confirmation prompt, and freezes the card after you confirm.
Session lifecycle
MCP sessions expire after 60 minutes of inactivity, but you can initialize a new session if an existing one expires. Access tokens last 1 hour and refresh tokens last 30 days of non-use. After refreshing an access token, you have to initialize a new MCP session because the current server does not rebind an existing session to the refreshed token.
API keys for scripts
For CI or another headless process, create an MCP API key through the authenticated Doow API:
POST /v1/auth/mcp-tokenGET /v1/auth/mcp-tokenDELETE /v1/auth/mcp-token/:idMCP API keys start with doow_mcp_ and accept mcp:read or mcp:write. Doow only grants scopes the member is allowed to use. Keys last up to 90 days, have lower request limits than OAuth sessions, and are checked against the member and organization each time they are used.
Troubleshooting
If authentication fails:
- Check your Doow account — Confirm you can sign in at app.doow.co
- Verify organization membership — MCP requires an active organization
- Check your role — Some tools require Admin access
- Retry authorization — If you denied access, restart the flow
For detailed error guidance, see Troubleshooting.