Connecting an AI client with OAuth
OAuth is the recommended way to connect — it doesn’t involve copying a token around, and the client can be revoked at any time.1
Open AI Connectors settings
Go to Settings → AI Connectors.
2
Connect your client
Follow your AI client’s instructions to connect to CallVault via MCP over HTTP, pointing it at your CallVault organization or workspace endpoint.
3
Authorize
Approve the connection when your AI client opens the authorization flow. The connected client appears in the AI Connectors list with its name, scope, and last-used time.
Connecting with a manual token
Some clients don’t support CallVault’s OAuth flow yet. For those, create a manual bearer token instead:1
Create a scoped token
In Settings → AI Connectors, click Create scoped token. Choose the client you’re setting up (Claude Code, Cursor, VS Code, Windsurf, or Generic MCP), give the token a name, and choose an organization and scope (organization-wide or a single workspace).
2
Copy the setup
After creating the token, CallVault shows the token value, the MCP endpoint URL, and a ready-to-paste setup snippet for the client you selected.
3
Paste it into your client
Follow the client-specific instructions below.
Claude Code
Run the command CallVault generates, which looks like:claude mcp list.
Cursor
Add the generated JSON snippet to.cursor/mcp.json (project-level) or ~/.cursor/mcp.json (global), preserving the Authorization header exactly as generated.
VS Code
Add the generated JSON snippet to.vscode/mcp.json or your VS Code MCP settings.
Windsurf
Add the generated JSON snippet to~/.codeium/windsurf/mcp_config.json.
Generic MCP client
Use the generated JSON snippet — it follows the standardmcpServers shape most MCP clients expect, with the endpoint URL and a bearer Authorization header.
Controlling what a token can access
Each manual token can be scoped to specific tool categories:
Toggle categories off for a token to restrict what that client can do — useful for giving an AI assistant read-only access to your calls without write or admin permissions.
Managing connections
From Settings → AI Connectors you can:- Revoke an OAuth-connected client — CallVault immediately rejects future requests from it
- Regenerate a manual token — the old token stops working immediately and a new one is issued
- Delete a manual token entirely

