# Claude auto-connect Source: https://molted.email/docs/claude-auto-connect Set Molted up once for your Claude Team or Enterprise organization, and everyone who is also in your Molted workspace is connected the first time they use it. A guide for workspace admins. > **Note:** Not available yet. Claude auto-connect builds on OAuth sign-in for the [Molted MCP server](https://molted.email/docs/mcp-server.md#claude-desktop-claudeai-and-chatgpt), which is coming. The **Claude auto-connect** card appears in your Molted settings once it is available for your workspace. Until then this page describes how it will work. Claude auto-connect is Claude's name for Enterprise Managed Auth. An owner of your Claude organization sets the Molted connector up once. After that, anyone in the organization who is also a member of your Molted workspace gets connected the first time Claude reaches for a Molted tool. Nobody sees a Connect card or a consent screen. Here is what happens underneath. When a person's Claude asks Molted for access, Claude sends a short-lived statement, signed by Claude, that says which organization they belong to and what their email address is. Molted checks the signature, finds the workspace and the person, and hands back an access token for the mailboxes you chose. That's the whole sign-in. ## Before you start You need three things. - A Claude Team or Enterprise organization, where you are an Owner or Primary Owner. Molted accepts only the **Claude-issued** kind of auto-connect for now, and Claude doesn't offer that kind in an organization that signs in through Okta. - The admin or owner role in your Molted workspace. - The people you want connected, already in your Molted workspace, each with a verified email address that is the same as the one on their Claude account. See [Who can be connected](#who-can-be-connected). Setup goes back and forth once. The issuer URL goes from Claude to Molted, and your tenant ID goes from Molted to Claude. Keep both tabs open. ## In Claude 1. In **Organization settings > Connectors**, add the Molted connector with the URL `https://mcp.molted.email/mcp`. 2. Open the connector. In its **Authentication** section, click **Set up** on the **Managed authorization** row. 3. Under **Identity source**, choose **Claude-issued**. 4. Copy the **Issuer URL**. It looks like `https://identity.anthropic.com/issuers/` followed by an ID that belongs to your organization. 5. Fill in **Tenant ID** with your Molted tenant ID (step 1 below). Claude marks this field optional, but Molted needs it. Without it every sign-in is refused, because the tenant ID is how Molted knows which workspace the person is signing in to. Leave this page open. You come back to it to run the test. ## In Molted Open **Settings** in the Molted app and find **Claude auto-connect** (`/app/settings#claude-auto-connect`). The card has four steps, in this order. 1. **Your tenant ID.** Click **Copy** and paste it into Claude's **Tenant ID** field. 2. **Claude issuer URL.** Paste the Issuer URL you copied from Claude, exactly as Claude shows it. Molted accepts only `https://identity.anthropic.com/issuers/` followed by your organization's ID, with nothing after the ID (not even a slash), and refuses anything else. 3. **Mailboxes and permissions.** Tick each mailbox Claude may use, and give each one **read**, **send** or **manage** (manage covers read and send). Every Claude connection in the workspace gets exactly this, whoever the person is. There is no "all mailboxes" option, and a mailbox you create later isn't added on its own, so come back here when you want Claude to use it. You need at least one mailbox, each with at least one permission. 4. **Turn it on**, then click **Save**. Only an admin or the owner can change these settings. Everyone else in the workspace sees them read-only. Turning auto-connect on, or giving Claude more access while it's on, also needs a password sign-in from the last 10 minutes. If yours is older, the card offers **Sign in again**, keeps what you entered, and you save once more when you're back. Now go back to Claude and click **Run test** under **Connection status**. A passing test means Claude signed a statement, Molted accepted it and returned a token. ## Who can be connected Only people who are already members of your Molted workspace. Molted never creates an account or adds anyone to the workspace through Claude. Someone in your Claude organization who isn't in the workspace is refused. Molted matches the person by email. The email on their Claude account has to equal the verified email of a member here. Letter case doesn't matter, but dots and plus tags do, so `alex+work@example.com` doesn't match `alex@example.com`. A member who hasn't verified their email can't be connected until they do. Neither can an address Molted itself receives mail for, such as one of your own mailboxes. A connection acts with the person's own role in the workspace, on top of the mailboxes and permissions you chose, so it never does more than they could do themselves. A viewer's connection only reads, even on a mailbox you gave send. Each connected person gets an API key named **Claude (managed connection)**, and admins see these in **Settings > Access**. ## How long a connection lasts An access token lasts one hour. When it runs out, Claude asks for a new one in the background and the person never notices. There's no refresh token to keep track of. When someone leaves your Claude organization, Claude stops vouching for them. The token they already hold still works until it expires, so for up to an hour. Removing someone from your Molted workspace ends their connection right away, because it revokes their keys. ## What disconnects people Three changes in the card sign out everyone connected through Claude auto-connect, all at once: - turning it off - changing the issuer URL - changing the mailboxes or permissions The card asks before it saves any of them, and afterwards says how many connections it ended. When you change the issuer or the scope and leave auto-connect on, Claude connects people again with the new settings the next time they use Molted. After turning it off, nobody is connected until you turn it on again. Revoking one person's **Claude (managed connection)** key signs them out too, but only until Claude next asks, and then they're connected again. To keep one person out, remove them from the workspace (see [Team and roles](https://molted.email/docs/team.md)). ## Troubleshooting Molted tells Claude only that a sign-in was refused, never why, so the reason doesn't leak to whoever sent the request. Claude's **Run test** shows which step failed and what came back. Work through these in order. **The test fails for everyone.** Check Claude's **Tenant ID** field first. Empty or wrong, it fails every sign-in, and it's the easiest one to miss. Then compare the issuer URL in Molted with the **Issuer URL** in Claude, character for character, and copy it again if in doubt. Make sure the card says **On**. **It worked, then stopped for everyone.** Look in the card for a yellow note that a chosen mailbox was deleted. While a deleted mailbox is in the list, Claude sign-ins fail. Click **Remove** on it and save. Someone may also have changed the issuer or turned auto-connect off. **One person can't connect.** Go through [Who can be connected](#who-can-be-connected) for that person. Are they a member here, with a verified email? Is it the same address as their Claude account, plus tags and all? If they connect but can't send, check their role, since a viewer only reads. **The card says to sign in again.** Turning it on or widening Claude's access needs a password sign-in from the last 10 minutes. Click **Sign in again**, and save when you're back. **Molted won't save the issuer.** It has to start with `https://identity.anthropic.com/issuers/` and match what Claude shows exactly. You also can't turn auto-connect off and change the issuer in the same save, so do one, save, then the other. **There's no Claude auto-connect card.** It shows only once Claude auto-connect is available for your workspace. See the note at the top of this page.