Quickstart
Create an account, add OpZero as a connector in Claude, approve the OAuth prompt, and ask for something. Nothing to install and no key to copy.
Connect OpZero to Claude
Create your OpZero account
Sign up at opzero.sh/auth. You will be asked to verify your email address before the account is usable — OpZero deploys real infrastructure under your name, so ownership of the address is checked at signup rather than assumed.
That is the only account you need. The connector in the next step authenticates against it.
Add the connector in Claude
In Claude, open Settings → Connectors and choose Add custom connector. Paste the OpZero endpoint:
https://opzero.sh/mcpClaude reads /.well-known/oauth-protected-resource from that URL, finds the authorization server at auth.opzero.sh, and registers itself. You do not enter a client ID, a secret, or a token.
Approve the OAuth prompt
Claude opens an OpZero sign-in window. Sign in with the account from step 1 and approve the requested access. OpZero issues Claude a short-lived access token (one hour) plus a refresh token, so the connection keeps working without you reauthorizing every session.
The flow is OAuth 2.1 with PKCE. Your password is never shared with Claude, and the grant is revocable from your dashboard at any time.
Ask for something
Start a new conversation and try one of these:
- “Deploy a page that says hello, and give me the link.”
- “Turn these notes into a nicely themed article and publish it.”
- “What have I deployed on OpZero so far?”
The last one calls get_system_status and is the cheapest way to confirm the connection is live and pointed at the right account.
What you are approving
OpZero advertises these scopes on its protected-resource metadata. Claude requests them during the flow:
| Scope | Grants |
|---|---|
mcp:tools | Listing and calling OpZero’s tools. |
mcp:deploy | Creating and updating deployments on your account. |
mcp:read | Reading your projects and deployment history. |
Older deploy / read / write scope names are still accepted for connectors registered before the rename.
Verifying the connection
If you want to see exactly who Claude is authenticated as, ask it to run diagnose_auth. It reports your token type, the identity behind it, the scopes granted, how long the session has left, and the health of every OAuth discovery endpoint. It is the first thing to reach for when something looks wrong.
Where to go next
Concepts explains what a project is, how deployments stack up, and what separates an app from an assistant from a hosted MCP server — worth ten minutes before you build anything with moving parts.
The tool reference lists everything OpZero can do, with parameters, if you would rather explore by capability.