Skip to main content

​
Prerequisites

  • AI assistant access is provisioned for your tenant.
  • Your user group holds at least one MCP permission — see Granting access. Without one the connection succeeds and offers nothing.
  • You know your Insight API address. It appears in the commands below as <api-fqdn>.

​
Command-line assistants

​
Claude Code

You are sent to your usual sign-in page. Once you have signed in, the assistant acts as you. The port is not arbitrary — see Why the port is fixed below.

​
Codex

Set the callback port in config.toml:
Confirm the client-id setting and the default callback path against a real sign-in before you rely on this in a rollout. The registered addresses allow any path on the loopback host, so the path itself is not the risk — the setting name is what varies between versions.

​
Hosted Claude connector

Claude on the web and Claude Desktop connect through Anthropic’s own callback addresses rather than a port on your machine. Those addresses are not allowed by default, so this does not work until someone adds them.
1

Add the connector callbacks

Someone holding Manage API clients opens Settings → Access → API clients and adds these two addresses to the MCP client:
2

Add the connector in Claude

Point it at https://<api-fqdn>/api/v3/mcp and sign in when prompted.
Leaving these off is a deliberate default: it means a tenant only reaches an outside service once someone has decided it should.

​
For Nobly staff and consultants

The nobly-mcp client belongs to your organisation’s own sign-in realm. If you sign in with a Nobly account instead, use the client that already exists there:
The permissions still apply in full: a Nobly account reaches only what its own groups and document rights allow.

​
Connection details worth knowing

​
Why the port is fixed

The sign-in service matches the callback address exactly, and does not accept “any port” for local addresses. An assistant that picks a random port each run will fail to complete sign-in, so the port has to be one that has been registered — 48123 for your organisation’s users, 48120 for Nobly accounts.

​
Allowed addresses are per tenant

Which callback addresses are accepted is your tenant’s decision, managed in Settings → Access → API clients. Out of the box only the local addresses above are allowed. Anyone holding Manage API clients can add others — a fixed-port local tool, or the hosted connector addresses. Removing the local addresses stops command-line assistants from signing in. They are restored whenever the sign-in service is updated, so removing them is a temporary measure, not a lock-out.

​
Sessions are short, and refresh tokens rotate

Access tokens last five minutes, and refresh tokens rotate: using one issues a replacement and retires the one you used. A well-behaved client handles this without you noticing. A tool that caches a refresh token and keeps presenting the same one instead of the replacement will have its session ended, and you will be asked to sign in again.

​
Your token is your token

The credential an assistant holds is an ordinary Nobly Insight sign-in for your account. It is not restricted to assistant use, and it carries no protection against being reused elsewhere — so treat it exactly as you would your own password, and do not paste it into tools you would not sign into directly.

​
Troubleshooting

Reporting

How data sources, dashboards, and elements fit together for the people who build and view reports.

Granting access

The permissions that decide which capabilities a user group’s assistants may use.

Single sign-on & federation

Sign in to Nobly Insight with your organisation’s own identity provider.