Set up Auth0 for Crewvana ChatGPT access

Crewvana uses Auth0 to sign users in to its ChatGPT integration. A Crewvana password, a tenant API key, and an Auth0 administrator account are not interchangeable. Each person should connect with their own Auth0 identity and their own Crewvana account.

This guide has two parts: one-time setup by a Crewvana/Auth0 operator, then connection by a tenant user. A tenant administrator can prepare their organization after the operator finishes the platform setup.

1. Crewvana/Auth0 operator: prepare the platform

1. Confirm the public MCP resource is https://support.crewvana.com/mcp and its protected-resource metadata names the intended Auth0 issuer. In Auth0, the Crewvana MCP API must use that exact resource as its audience, RS256 signing, the required Crewvana scopes, and access tokens no longer than Crewvana's configured maximum (one hour by default).
2. Configure an OAuth client path supported by ChatGPT (Client ID Metadata Documents, dynamic client registration, or a predefined client). Require authorization code with S256 PKCE. Allow the exact redirect URI shown in the ChatGPT connection's management page. The authorization flow must carry the MCP resource and issue a token with the correct audience, scopes, and selected organization ID.
3. Create a dedicated Auth0 Machine-to-Machine application for Crewvana Organization management. Grant only read:organizations, create:organizations, read:organization_members, create:organization_members, and delete:organization_members on the Auth0 Management API.
4. Set the production Crewvana environment values AUTH0_MCP_ISSUER, AUTH0_MCP_MANAGEMENT_CLIENT_ID, AUTH0_MCP_MANAGEMENT_CLIENT_SECRET, and AUTH0_MCP_SYNC_ORGANIZATIONS=true. Confirm AUTH0_MCP_AUDIENCE and the token-lifetime setting match the Auth0 API. Store the client secret only in the deployment secret store, never in a knowledge-base article or a user's browser. Refresh Crewvana's application configuration after changing these values.
5. Run the tenant-scoped Auth0 Organization sync or have an authorized tenant administrator select Settings > Integrations > ChatGPT > Prepare ChatGPT access. This creates and binds one Auth0 Organization for the active Crewvana tenant. The scheduled sync subsequently reconciles known linked members.

Organization preparation does not create a usable Auth0 login. For the first user, make sure an Auth0 user identity exists, can authenticate using the intended connection (for example, Auth0 database email/password rather than SSO), and is allowed into the new Organization. The automatic membership sync only knows Auth0 subjects after an account link exists, so the operator may need to add the first user to the Organization or configure an approved first-login membership policy.

2. Tenant user: connect your account

1. Sign in to your own Crewvana tenant account and open Settings > Integrations > ChatGPT. If the card says Crewvana must finish Auth0 configuration, ask Crewvana support to complete part 1. If it says access has not been prepared, ask a tenant administrator with integration-update permission to select Prepare ChatGPT access.
2. In ChatGPT, enable Developer mode if it is available to your account, then add the Crewvana MCP server at https://support.crewvana.com/mcp as a connection. Follow the current OpenAI connection instructions at https://developers.openai.com/plugins/deploy/connect-chatgpt.
3. When Auth0 opens, use the Auth0 credentials for your Crewvana-linked identity. Do not use an Auth0 administrator's credentials or assume your Crewvana password works in Auth0.
4. When Crewvana asks to link the account, sign in to Crewvana, select the tenant you are authorized to use, and explicitly confirm. The link is to your proven Auth0 subject and Crewvana account, not to an email address alone.
5. Try a read-only request first. Your existing Crewvana permissions still determine what the integration can access. Message sending and schedule changes require separate, exact confirmation.

If login fails, ask the operator to check the Auth0 user and connection, Organization membership, OAuth client callback/PKCE settings, and API token audience/scopes/lifetime. If login succeeds but a tool is denied, check the Crewvana tenant membership and the user's tenant-local permissions. Never send passwords, API keys, or client secrets to support in a chat message.