PayCanvas MCP connector setup

MCP is a secure way for an AI assistant to ask PayCanvas for authorized information without receiving your PayCanvas password. The public payroll connector address is:

https://app.paycanvas.io/api/mcp/operator

Prerequisites

• A compatible MCP client, such as ChatGPT, Codex, or Claude.
• Active payroll-operator access in PayCanvas.
• Your PayCanvas sign-in credentials.
• An authenticator app. PayCanvas requires a six-digit verification code for connector use.

Connect from a compatible client

1. Open the client's Add remote MCP server or Add custom connector flow.
2. If the client asks for a connection type, choose Streamable HTTP. You do not need to configure the transport yourself.
3. Enter https://app.paycanvas.io/api/mcp/operator exactly.
4. Choose OAuth or Sign in with PayCanvas. This opens a secure PayCanvas sign-in page. Do not paste a token or browser session value.
5. Start authentication.
6. On the PayCanvas page, sign in, enter the six-digit code from your authenticator app, and confirm the client name.
7. Review the read permission and any optional write permissions.
8. Select Allow connection.
9. Back in the client, ask: “What can you help me do in PayCanvas?”

For Codex configuration, the equivalent entry is:

[mcp_servers.paycanvas_operator]
url = "https://app.paycanvas.io/api/mcp/operator"
auth = "oauth"
default_tools_approval_mode = "prompt"
required = true

Then authenticate with your Codex MCP login flow. Local Codex and Claude Code loopback callbacks on localhost or 127.0.0.1 are accepted.

Expected result

The assistant can see the PayCanvas actions available to your role. It can help select an authorized payroll account, check readiness, review periods and results, explain amounts and unresolved issues, and inspect safe audit evidence. Any optional action that changes data still requires the right permission, a preview, and your confirmation.

Important boundaries

• You should not need to find or paste internal account, period, run, or job IDs; the connector resolves them from PayCanvas results.
• A connector can access only payroll accounts allowed by your active membership.
• The connector does not return passwords, raw reports, original provider responses, or private employee mappings.
• Use a separate OAuth client if you also have a platform connector. One client cannot span both protected resources.

Troubleshooting

• The PayCanvas sign-in page never opens: verify the connector address and confirm the client supports remote MCP connections with OAuth.
• Membership required: ask the person who manages access for your payroll account to verify your payroll-operator membership.
• The verification screen repeats: enter a new six-digit code from your authenticator app. Codes expire quickly, so do not reuse an older one.
• Callback rejected: use the client's standard ChatGPT, Claude, or local loopback callback; arbitrary remote callbacks are rejected.

Related articles

• MCP permissions and disconnecting
• MCP example workflows
• Security and privacy