Sign in with your SETTO account
Connect claude.ai, ChatGPT, Codex or Claude Code to SETTO with OAuth instead of a token. You approve six permissions at app.setto.io, the app acts as you, every change lands in «Actividad», and «Conexiones» disconnects it.
claude.ai, ChatGPT and Codex connect to remote MCP servers only through OAuth,
and Claude Code supports it too. SETTO is its own OAuth authorization server, so
these apps connect to the MCP server at
https://docs.setto.io/mcp with your SETTO account: there is no token to
create, copy or paste. You approve what the app may do on a consent screen at
app.setto.io, and you can cut it off at any time.
How it works
- You add
https://docs.setto.io/mcpin the app. - The app opens SETTO in your browser. If you are not signed in to SETTO yet, you sign in first and come back to the same request.
- SETTO's consent screen names the app, its domain, the address you will return to and the account you are signed in with, and lists the six permissions with every one the app asked for already ticked. Untick what you do not want to allow; «Leer» is always included.
- You choose Permitir acceso. SETTO sends you back to the app, which now holds an access token for your account.
- From then on every tool call acts as you: it reaches the tournaments you manage — the ones you created, the ones you were invited to manage and those of every organization you belong to, today and later — and only with the permissions you granted. Every change it makes is recorded in «Actividad».
The access token is a SETTO API token like any other: the same setto_live_
prefix, the same Authorization: Bearer header, so the
REST API accepts it too. It never appears under
«Tokens de API»; you find the app under «Conexiones» instead.
Wrong account?
The consent screen shows the account you are signed in with. If it is not the one you want, choose ¿No eres tú? Cerrar sesión, sign in with the right account, and the same request continues there. A request lasts 10 minutes.
The six permissions
| Permission («Permiso») | id | What it allows | Used today by |
|---|---|---|---|
| «Leer» | read | See tournaments, categories, teams, results, schedules and the activity. Always included | Every read tool, search_tournament, and propose_pool_per_court_schedule, preview_team_withdrawal, preview_division_format, preview_pools and preview_draw (they write nothing) |
| «Programar partidos» | schedule | Set and move the day, time and court of games not yet played | apply_schedule_placements |
| «Gestionar torneos» | manage | Create and edit tournaments, categories, seeds, teams and players; register teams; replace a player («Sustitución») or withdraw a team («Baja»); set a category's format, its groups and its knockout draw | The fifteen setup tools: create_tournament, update_tournament, publish_tournament, set_tournament_lifecycle, create_division, update_division, delete_division, set_division_seeds, register_team, register_teams, update_team, remove_team, update_player, substitute_player, withdraw_team; and the six draw tools: apply_division_format, append_elimination_round, apply_pools, apply_draw, confirm_draw, set_game_teams |
| «Cargar resultados» | results | Record, correct and clear game results | record_game_result, clear_game_result |
| «Página pública» | landing | Change the design, sections, sponsors and visibility of the public page | No tool yet |
| «Enviar comunicaciones» | communications | Email the participants of your tournaments | No tool yet |
No permission changes a price, a paid mark, a payment record or a refund; a withdrawal closes the team's unpaid payment links. Every permission is also capped by what you can do in the dashboard yourself: an app never does more than you could. API tokens carry the same six permissions — see What a token can change.
A permission you untick is not granted, and the app cannot add it halfway through a session. To change what an app may do, connect it again from the app: the new consent replaces the permissions it had (the consent screen says so when you already connected it). Or disconnect it in «Conexiones» first.
Connect your app
The server URL is the same everywhere: https://docs.setto.io/mcp.
- In claude.ai open Customize → Connectors, choose + Add and then Add custom connector.
- Name it
SETTO, pastehttps://docs.setto.io/mcpand continue. claude.ai finds SETTO's sign-in by itself, so leave the OAuth client fields empty. - Choose Add, then sign in when claude.ai asks: SETTO's consent screen opens, you approve the permissions and claude.ai lists the SETTO tools.
Custom connectors work on every Claude plan; on Free you can add one. On Team and Enterprise an owner adds the connector once, in Organization settings → Connectors, and then each member chooses Connect in Customize → Connectors and signs in with their own SETTO account. Claude Desktop uses the same connector.
Other clients:
- Claude Desktop uses the connectors of your Claude account: add SETTO as in the claude.ai tab.
- VS Code can sign in too: add the server without its
headersblock and VS Code opens SETTO's sign-in. - Cursor cannot sign in to SETTO yet: it comes back to a
cursor://address, and SETTO's sign-in only returns tohttps://and local (http://localhost) addresses. Connect Cursor with an API token, as on the MCP server page.
«Conexiones»: see and disconnect apps
In app.setto.io → Configuración → Conexiones you see every app connected to your account: its name and domain, the permissions you granted, when you connected it and when it was last used. An app that publishes its own client metadata shows a verified domain; any other app's name is the one it declared about itself.
Desconectar cuts the app off at once. Its next tool call fails, its next request is refused, and it has to ask you to sign in again. You can have up to 25 connected apps.
«Actividad»
Every change an app or a token makes in SETTO is recorded in «Actividad»:
who acted (you, through which app or token), what changed, when, and whether it
worked or was refused, with its code. Creating or revoking a token, and
connecting or disconnecting an app, are recorded too. You find it in
Configuración → Actividad (your apps and tokens), in an organization's
settings (its tournaments and its tokens) and in each tournament's menu. A
connected app reads the changes apps and tokens made in the tournaments it
reaches with the list_activity tool (GET /v1/external/activity). What you
edit by hand in a tournament from the dashboard is not in it. If saving a row
fails, the change stands, that row is missing and SETTO gets an alert.
Troubleshooting
| What you see | Why | What to do |
|---|---|---|
A tool error unauthorized, or the app asks you to sign in again | You disconnected the app in «Conexiones», or its access expired | Try once more: the app refreshes its access or opens SETTO's sign-in. If it still fails, connect SETTO again from the app |
INSUFFICIENT_SCOPE | The connection lacks the permission that tool needs, for example «Programar partidos» | Connect SETTO again from the app and leave that permission ticked on the consent screen |
| «La solicitud expiró» on the consent screen | A sign-in request lasts 10 minutes | Start connecting again from the app |
| «Tienes demasiadas aplicaciones conectadas» | You reached 25 connected apps | Disconnect one in Configuración → Conexiones and try again |
| Cursor cannot sign in | It returns to a cursor:// address, which SETTO does not accept yet | Use an API token in Cursor |
For developers
SETTO's api is its own OAuth 2.1 authorization server, and the MCP server is a protected resource of it.
| Authorization server metadata | https://api.setto.io/.well-known/oauth-authorization-server (RFC 8414; the same document at /.well-known/openid-configuration) |
| Issuer | https://api.setto.io, also sent as iss on every authorization response that goes back to the app (RFC 9207) |
| Protected resource metadata | https://docs.setto.io/.well-known/oauth-protected-resource/mcp (RFC 9728), named by resource_metadata in every /mcp 401 |
| Endpoints | https://api.setto.io/v1/oauth/authorize, /v1/oauth/token, /v1/oauth/register, /v1/oauth/revoke |
| Grant | Authorization code with PKCE, S256 only; public clients only (token_endpoint_auth_method: none) |
| Client identity | A Client ID Metadata Document (an https:// client_id, preferred) or Dynamic Client Registration |
| Redirect URIs | https://, or loopback http:// (localhost, 127.0.0.1, [::1], any port). Private-use schemes such as cursor:// are refused |
| Authorization errors | An unknown client or a redirect URI that is not registered: a 400 JSON, never a redirect. Past that, a bad request is a 400 JSON with no Location for an https:// redirect URI, and a 302 with error, state and iss for a loopback one. Choosing No permitir on the consent screen always goes back to the app |
| Scopes | read schedule manage results landing communications, space-separated. read is always granted; openid, offline_access, profile and email are ignored |
| Resource (RFC 8707) | https://docs.setto.io/mcp (the default) or https://api.setto.io/v1/external |
| Access token | 30 days. A SETTO API token (setto_live_…) |
| Refresh token | Rotates on every use; the app session ends 90 days after its sign-in |
| Revocation | POST /v1/oauth/revoke (RFC 7009), or «Desconectar» in «Conexiones» |
The /mcp 401 deliberately carries no scope=: clients then request what the
protected-resource metadata lists — all six permissions — and the organizer
decides on the consent screen.
Related
- MCP server — the tools, the scheduling flow, and connecting with an API token.
- Authentication — API tokens, the six permissions and the difference between 401 and 403.
- Agent Skills — the client-agnostic alternative.