Claude.ai and Claude Desktop

These sign in over OAuth. You paste a URL, approve in a browser tab, and no secret is ever copied anywhere.

Add the connector

In Claude.ai, Claude Desktop or a ChatGPT connector, add a custom connector and give it this address:

server URL · that is the whole of it

https://tabtunnel.dev/v1/mcp

There is no token to make and no header to fill in. Leave any such field empty.

What happens next

The app asks us what it needs, and we tell it where to send you.
A TabTunnel page opens. Sign in if you are not already, and pick the organization the connector should reach.
Approve it. The app comes back holding its own token.

That token shows up in your dashboard's Tokens list beside any you minted by hand, named for the app that asked, and is revoked from there the same way. Revoking it disconnects the connector and nothing else.

Why this is the better path

A pasted token is a password in a config file, a clipboard and probably a chat window. Here the secret is minted by the app and never shown to anybody, including you — so there is nothing to leak, and taking it back is one click in a list you already have.

If it does not connect

It asks for an API key	It has not found the OAuth path. Check the URL is exactly the one above, with no trailing path, and that the app supports remote MCP servers rather than only local ones.
Approval says the app asked for the wrong thing	A registered app may be approved for one scope, `mcp`, and no other. An app that asks only for something else is turned away, and the page says which app it was.
It connects but sees no browsers	You approved it for an organization with no enrolled browser. Revoke it in Tokens and add it again, picking the right one.

Next: what it can do.

Is something here wrong, or missing? Tell us.