# Claude: claude.ai, Desktop and Code

A custom connector with sign-in (no keys to paste) and Claude Code from the terminal.

Guide Read-only Sign-in

**Before you start.** Whoever connects needs to be able to manage the agency’s API keys, a Business plan or higher (or support-approved access), to be past the free trial and to have a verified email.

## Add the connector in claude.ai

It works on Free (one custom connector), Pro and Max, and it’s available on the web, Claude Desktop and mobile. You paste no key: you sign in with your ByDomu account.

- In Claude, **Customize › Connectors › Add custom connector**.
- Name ByDomu and the URL `https://mcp.bydomu.com/mcp`. Leave the client ID and secret empty: Claude registers itself.
- Add and then Connect: ByDomu opens. Sign in if needed, review the agency and the permissions (read-only) and tap Allow.
- In each chat, turn it on under **+ › Connectors**. Under Customize › Connectors you can block tools you don’t want to use.

Menu names are those in Anthropic’s English docs; in other languages they appear translated. Claude Desktop uses the same connectors from your account: nothing else to configure. If you prefer a key in Desktop, use mcp-remote (a community package):

```
// claude_desktop_config.json: solo si necesitas una clave en vez de iniciar sesión
{
  "mcpServers": {
    "bydomu": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.bydomu.com/mcp", "--header", "Authorization:${BYDOMU_AUTH}"],
      "env": { "BYDOMU_AUTH": "Bearer domu_sk_live_XXXXXXXX" }
    }
  }
}
```

## On Team and Enterprise

An Owner adds it for the whole organization in **Organization settings › Connectors › Add › Custom › Web**, with the same URL. Then each person connects it in Customize › Connectors › Connect and signs in with their ByDomu account; only someone who manages the agency’s API keys can allow it. Each connection reads the whole agency read-only, not just what’s assigned to that person.

## Claude Code

Add it without a key and authenticate with /mcp (it opens the browser to allow access in ByDomu), or pass a read-only secret key as a header. To share it with your team, .mcp.json supports environment variables: the key never lands in the repository.

Sign-in:

```
# Con inicio de sesión (sin clave)
claude mcp add --transport http bydomu https://mcp.bydomu.com/mcp
# luego, dentro de Claude Code:
/mcp        # elige bydomu → Authenticate → Permitir en ByDomu
```

Key:

```
# Con una clave secreta de solo lectura, leída de una variable de entorno
claude mcp add --transport http bydomu https://mcp.bydomu.com/mcp \
  --header "Authorization: Bearer $BYDOMU_API_KEY"

# --scope local (por defecto, este proyecto) · project (.mcp.json) · user (todos)
```

.mcp.json:

```
// .mcp.json en la raíz del proyecto (--scope project). Sin la clave escrita:
{
  "mcpServers": {
    "bydomu": {
      "type": "http",
      "url": "https://mcp.bydomu.com/mcp",
      "headers": { "Authorization": "Bearer ${BYDOMU_API_KEY}" }
    }
  }
}
```

## Test it

Ask “Give me a summary of the agency”: it should use get_summary and answer with the plan, permissions and counts. Then something like “What appointments do I have tomorrow?” or “Find apartments for rent in Medellín under 4 million”.

- **403** On the ByDomu screen: your plan doesn’t include connecting apps, you’re on the free trial, your email isn’t verified or you don’t manage API keys.
- **401** Someone removed access in Connected apps or 30 days passed without use: connect again.

## What it can do, how to revoke it and good practices

The server is read-only: the AI can query, but it doesn’t create, change or delete anything, and it never messages your customers. It only sees what these permissions allow, with a secret key’s limit (60 requests per minute).

It can Permission

Search and view published listings `portal:read`

Search and view contacts `contacts:read`

Calendar and appointments `appointments:read`

Read a contact’s messages `conversations:read`

Pipelines and deals `deals:read`

Pending tasks `tasks:read`

With sign-in, each connection gets its own read-only credential. To remove it, go to Settings › API Keys › Connected apps › Remove access: the app’s next call fails and it has to ask for permission again. There you see who connected it, when it was last used and how many calls it made in 30 days. Access lasts while it’s used; after 30 days without use it must be allowed again.

- One key per integration, with only the read permissions it uses. Leave conversations:read out if you don’t need messages.
- The key goes in an environment variable or the client’s secret store, never pasted into a chat, a repository file or a URL.
- What ByDomu returns includes text your customers wrote: treat it as data, not instructions. Don’t chain this connector with tools that send emails or messages without a person approving it.
- Review Connected apps now and then and remove what’s no longer used.