Connect Claude or ChatGPT to your Laravel site, with no key to copy

Every kitloom site has an MCP server at https://your-site/mcp: an AI agent connected to it writes posts, fixes SEO, answers 404s with redirects and reads the day's orders, with the rights of its user. Until today, connecting one meant a key. You made an application password in the admin, then copied Authorization: Bearer 12|… into every client: a header in Claude Code's command, a headers block in Cursor's mcp.json, a Request headers field in claude.ai's advanced settings. ChatGPT, whose connectors take no headers, needed the key inside the address itself.

A key copied that way ends up in dotfiles, in screenshots and in chat histories, and nobody remembers which agent holds which one. WordPress has nothing better to offer here: it has no sign-in an MCP client can use, so an agent reaches a WordPress site with an application password too, usually kept in the settings of a proxy on your computer.

Now an agent signs in to your site the way you sign in to an app with Google: you give it the address, the site asks you to approve it, and that is all.

How it goes

In the admin, AI agents → Connect an agent shows the address and what to do in each client.

claude.ai — on the web, on a phone and in Claude Desktop: Settings → Connectors → Add custom connector, any name and the address, the advanced settings left empty, then Add and Connect.

ChatGPT: Settings → Apps & Connectors → Advanced settings, turn Developer mode on, then Create — any name, the address, OAuth as the authentication — and connect.

Claude Code, with nothing but the address:

claude mcp add --transport http kitloom https://your-site/mcp

Cursor and VS Code: Add to Cursor and Add to VS Code on the same page install the server in one click, or mcp.json takes the address alone:

{
  "mcpServers": {
    "kitloom": { "url": "https://your-site/mcp" }
  }
}

The first time the agent uses the site, a browser window opens. You sign in to the site — two-factor included, if it is on — and see a page of the site's own: which agent asks to connect, where you will be sent back, and what it will be able to do. Approve, and the agent is connected. It now works with your rights: it reads what you may read and writes what you may write, through the same code your admin uses.

Connected agents, and Revoke

The agents you approved are listed under Connected agents on the same page: the name each gave itself, since when, and when it will ask you to sign in again. Revoke stops one at once — its next request is refused, and so is its next attempt to renew its access. To use it again, connect it again. In Nova it is the same panel: tick the agents and press Save.

An agent's access lasts a day, and it renews it by itself for 90 days; then it asks you to sign in again. The activity log shows its changes under its user, and every save keeps a revision it can be undone from. An agent that runs a site for you deserves a user of its own with a narrow role — an editor for content, not an administrator: connect it signed in as that user.

What is under it

The sign-in is Laravel Passport, installed with kitloom/ai. Nothing is changed in the application — no api guard, nothing on the user model. A client speaks the MCP authorization spec on its own:

• /mcp answers its first request with a 401 that names /.well-known/oauth-protected-resource/mcp, which leads it to the site's sign-in;
• it registers itself at POST /oauth/register (dynamic client registration, ten a minute from one address);
• it sends you to /oauth/authorize with PKCE — the site's own login for a guest, then the approval page — and takes its tokens from /oauth/token;
• one scope, mcp:use; clients are sent back only where they registered: claude.ai and ChatGPT to their own pages, Claude Code and VS Code to a loopback address, Cursor to cursor://.

While AI agents are off, all of it answers 404; a user without the use AI agents permission is refused on the approval page.

On a server, and on several

Passport signs every token with a key pair. On one server it is made the first time an agent connects, in storage/, and there is nothing to do. The pair must outlive a deploy — a new one signs every agent out — so the deploy kit keeps it on every target: the server, Forge and Ploi targets make it once where storage/ lasts, and on Docker, DigitalOcean App Platform and Laravel Cloud, whose disks do not, it lives in the environment:

php artisan kitloom:passport-keys   # PASSPORT_PRIVATE_KEY="…" and PASSPORT_PUBLIC_KEY="…", for the platform's secrets

Keys stay, for the rest

A key is still the way for a client that does not sign in, for an agent that may only read, and for an automation: Create a key on the same page makes one, shows it once, with the settings to paste. A read-only key gets the reading tools only; revoking it stops the agent at once.

Watch it

Connect an AI agent to your site: the address, the approval, Connected agents and Revoke

Try it

Open a sandbox in one click, with no sign-up: Filament or Nova — then AI agents → Connect an agent, and paste the address into your own Claude, ChatGPT or Cursor. Every client, the keys and the configuration are in the AI Agents guide; what an agent does once it is in, in Laravel CMS with an MCP server.