PayCanvas's public MCP connector lets a compatible assistant request authorized payroll information without receiving your password. It uses PayCanvas sign-in, account membership, MFA, and reviewed connector permissions. The connector address is:
https://app.paycanvas.io/api/mcp/operator
Prerequisites
- A compatible MCP client, such as ChatGPT, Codex, or Claude.
- Active payroll-operator access in PayCanvas.
- Your PayCanvas sign-in credentials.
- An authenticator app. PayCanvas requires a six-digit verification code for connector use.
Connect from a compatible client
- Open the client's Add remote MCP server or Add custom connector flow.
- If the client asks for a connection type, choose Streamable HTTP. You do not need to configure the transport yourself.
- Enter
https://app.paycanvas.io/api/mcp/operatorexactly. - Choose OAuth or Sign in with PayCanvas. This opens a secure PayCanvas sign-in page. Do not paste a token or browser session value.
- Start authentication.
- On the PayCanvas page, sign in, enter the six-digit code from your authenticator app, and confirm the client name.
- Review the read permission and any optional write permissions. Optional actions start off. Select only the actions this connection should be able to preview and perform after confirmation.
- Select Allow connection.
- Back in the client, ask: “What can you help me do in PayCanvas?”
Client menus and configuration fields can change. Use your client's supported remote-MCP or custom-connector setup and its OAuth sign-in flow; do not add a bearer-token environment variable or paste a browser token. Local clients may use their standard HTTP loopback callback on localhost or 127.0.0.1.
Expected result
The assistant can see the PayCanvas actions available to your role. It can help select an authorized payroll account, check readiness, review periods and results, explain amounts and unresolved issues, and inspect safe audit evidence. Any optional action that changes data still requires the right permission, a preview, and your confirmation.
Important boundaries
- You should not need to find or paste internal account, period, run, or job IDs; the connector resolves them from PayCanvas results.
- A connector can access only payroll accounts allowed by your active membership.
- Adding another active payroll-account membership becomes effective on the next authorized request; reinstalling the connector is not required.
- The connector does not return passwords, raw reports, original provider responses, or private employee mappings.
- The public connector never grants access to PayCanvas's private platform-administration tools.
Troubleshooting
- The PayCanvas sign-in page never opens: verify the connector address and confirm the client supports remote MCP connections with OAuth.
- Membership required: ask the person who manages access for your payroll account to verify your payroll-operator membership.
- The verification screen repeats: enter a new six-digit code from your authenticator app. Codes expire quickly, so do not reuse an older one.
- Callback rejected: restart the connection from the client's standard connector flow. PayCanvas accepts supported ChatGPT and Claude callback forms and local HTTP loopbacks; arbitrary remote callbacks are rejected.
- You cannot find a connector menu: remote MCP support depends on the client and account plan. This PayCanvas guide does not make that client feature available.