First No-Terminal AI Connection: Claude Desktop Talks to a Client CRM via OAuth

Why Care?

Every client collaborator we serve is terminal-poor and mobile-native: they will click a link and sign in; they will never edit a config file or paste an API key. The architecture bet has been that MCP's OAuth flow makes that persona servable — one URL, one login, no keys. Tonight the bet paid out: Claude Desktop completed the full OAuth dance against a client's self-hosted Twenty CRM and ran real tool calls as the logged-in user. The first cell of the 2-vendors × 2-form-factors connector matrix is green.

What's New?

• Operator pilot passed (Phase 4, step 2): custom connector added in Claude Desktop → OAuth discovery → dynamic client registration → Twenty login in the browser → tool calls listing real CRM data. Zero secrets touched the client side of the wire.

• TRUST_PROXY=1 joins the standard deploy config. The pilot's first attempt died with "Couldn't register with the sign-in service" — Twenty behind Railway's proxy advertised http:// OAuth endpoints (Express wasn't trusting X-Forwarded-Proto), and Railway's http→https redirect is a 301 that drops POST bodies, killing client registration. One variable fixed both client instances; the runbook and both connector docs now carry the lesson: the OAuth discovery metadata must be https-perfect, and it's the first thing to check when a connector fails with an opaque error.

• The client-facing setup doc got its first battle scars: the "server with this URL already exists → click Connect on the existing entry" recovery branch, and a heads-up that per-tool permission pop-ups are the AI app being careful, not the connection breaking ("Always allow" quiets them).

• Findings logged where the architecture is decided: the ai-labs secrets/capability-plane exploration's Findings section now holds the full matrix-cell result, verbatim friction included.

What's Next

The write-path check and reach-edu's connector (same fix already live there), the mobile spot-check (connectors follow the account, so the phone should Just Work — verify, don't assume), and then the real acceptance test: one actual terminal-poor stakeholder, handed a link, saying "help me set this up" to their own AI — with us watching the friction instead of rescuing it.