Pick your client and fill in your details. The steps update as you type.
Nothing you type here leaves your browser. The page only builds text for you to copy, and it never asks for a token.
- 1. Issue a token for that user
php please mcp:token [email protected] --name="Claude Code"The token prints once, as
mcp_<id>_<secret>, followed by ready-to-paste snippets. The user also needs the Access MCP permission on a role. Super admins already have it, and the command warns you when it's missing. - 2. Add the server to Claude Code
claude mcp add --transport http statamic https://example.com/mcp/statamic \ --header "Authorization: Bearer mcp_..."Replace
mcp_...with your token. Pasting this puts the token in your shell history, so use a leading space withHIST_IGNORE_SPACEor clean up withhistory -d. - 3. Try it
Ask the agent which collections your site has. It calls
statamic_overviewand answers from what this user may see.
Token mode or OAuth mode#
The client decides. A client that lets you set an Authorization header uses token mode, and a connector client that only takes a URL needs OAuth mode.
| Token mode | OAuth mode | |
|---|---|---|
| Clients | Claude Code, Cursor, MCP Inspector, anything that can send a static header | claude.ai, Claude Desktop, ChatGPT |
| Who acts | The Statamic user you issued the token for | The Statamic user who logged in and approved |
| Extra packages | None | laravel/passport |
| Database | None | One for Passport’s own tables, SQLite is fine |
| Site must be public | No | Yes, connector clients reach it over HTTPS from the internet |
| Your users | Stay where they are | Stay where they are, file users included |
Individual claude.ai and Claude Desktop connectors can’t send static headers. Static headers there are an org-admin beta for Team and Enterprise plans, so use OAuth mode for those clients.
A server runs one mode at a time, set by STATAMIC_MCP_AUTH. Token mode is the default. Details are in Token mode and OAuth mode.
Give each agent its own user#
The token is the user. An agent connected with your super admin account can do everything you can, so create a user and role for it unless you want that. Permissions has recipes, and a simulator that shows what any role can call.
If it doesn’t connect#
Run the doctor first. It names every problem at once and prints the fix for each.
php please mcp:doctorThe most common answers are a 401, meaning the token is wrong or gone, and a 403, meaning the user lacks Access MCP. Troubleshooting covers the rest.