Cravit Gateway guides

Administrator guide

This guide walks you through the Cravit Gateway admin console: signing in for the first time, setting up two-factor authentication, giving your colleagues access, and controlling what the AI is allowed to do in your Odoo.

Everything in this guide applies to your own organisation only. You cannot see or affect any other Cravit customer.

1. Signing in for the first time

Open the admin console address in your browser. You will see the sign-in screen.

1. In the first box, enter your tenant name. This is the short code Cravit gave you for your organisation (for example “acme”).
2. In the second box, paste the admin key that starts with cga_.
3. Click Sign in.

2. Setting up two-factor authentication

Two-factor authentication is required for every administrator and cannot be skipped. Even if someone else obtained your admin key, they still could not get into your console without your phone.

1. Open an authenticator app on your phone. Google Authenticator, Microsoft Authenticator, Authy and 1Password all work.
2. Use the app to scan the QR code on screen. If your phone cannot scan it, click “Can't scan? Enter this key manually” and type the key into the app instead.
3. Your app will start showing a 6-digit code that changes every 30 seconds. Type the current code into the box and click Confirm and continue.

3. Finding your way around

After signing in you land on the Dashboard. While your account is new it opens with a short Getting started checklist that ticks itself off as you complete each step. The menu on the left is your whole console:

• Dashboard: an overview of your account, the last seven days of AI activity, and settings you can manage yourself.
• Users: the people (and AI assistants) who are allowed to connect.
• Roles: rules controlling exactly what the AI may read or change in your Odoo.
• Audit logs: a permanent record of every action and every refusal.

4. Giving someone access

Each person who wants to use AI with your Odoo needs their own gateway key. Go to Users and click the “Create a user” header to open the form.

• Subject: a name to identify this person, usually their email address.
• Role / profile: which role limits this person (see section 5). A user with no role is marked all models in the list: they are not limited to a list of models, only by Read only / Read + write.
• Scopes: choose “Read only” if they should only look at data, or “Read + write” if they also need to make changes.
• Odoo login and Odoo API key: that person's own Odoo credentials. This matters: the AI acts inside Odoo as that specific person, so it can never see or do more than they could themselves.

Generating an Odoo API key

Each user creates their own key in Odoo. It takes about a minute:

1. In Odoo, click your name or avatar in the top-right corner and select My Profile (sometimes labelled Preferences).

   

2. Open the Security tab.
3. Under API Keys, click Add API Key, then confirm your password when asked.

   

4. Enter a clear description such as “Cravit Gateway”. This is the only way to recognise the key later.
5. Set the duration. Read the warning below before choosing.
6. Click Generate Key and copy it immediately. Odoo shows it exactly once, with a note that it provides full access to the account; there is no way to view it again afterwards.

When you click Create user, their gateway key appears once. Copy connection instructions puts the server address, the key and the connection steps into one message you can paste into an email or chat to that person.

Everyone you have added appears in the Active users list. The Actions menu on each row lets you update their Odoo key, issue a new gateway key, grant or revoke staging access, add a personal instruction for the AI, or deactivate them (which keeps their record and can be undone). The Access column shows which environments each person holds a key for.

Staging and production (optional)

If Cravit has configured a staging copy of your Odoo as well as production, you can give people access to either or both. The rule is simple: one key per environment, and each key only works on its own connector.

• A person's normal key reaches production. Tick Also grant staging access when creating them, or choose Grant staging access from their Actions menu later, and they receive a second key for staging. Both keys appear in the hand-off message with their own server address (the staging one ends in /staging/mcp).
• In their assistant the person adds staging as a separate connector, so they can always see which one they are talking to. A production key pasted into the staging connector (or the other way round) is refused with a message saying which address to use instead.
• The second key is tied to the same user: the same role, scopes and instructions apply, and deactivating the person switches off both keys. You can revoke the staging key on its own at any time.
• The AI is told which environment it is working in on every answer, and on staging it says so at the start of a conversation. Changes still need confirmation on staging, exactly as on production, so nobody learns a different habit on the test system.
• If staging is a fresh copy of production (for example after an Odoo.sh rebuild), the person's production Odoo API key usually still works there. Copy production Odoo key to staging in the Actions menu saves re-entering it; the row is marked until a separate staging key is enrolled.
• On the Dashboard, Test production and Test staging check that each Odoo answers, that the configured database still exists and that the connection credential works. After an Odoo.sh rebuild, run it before telling people staging is ready.

The Audit logs page has an environment filter, so you can look at staging and production activity separately.

5. Controlling what the AI can do

Roles are how you limit the AI. A role is a list of exactly what is allowed. Anything not on the list is automatically refused. Click + Create role to open the role editor beside the list; to change an existing role, click Edit on its row. The editor warns you if you move on with unsaved changes.

1. Give the role a clear name, such as “Sales read-only”.
2. Add the Odoo records it may touch (for example sale.order or res.partner), and tick Read, Create or Update for each one.
3. Save the role, then assign it to a person from the Users page.

6. Checking what happened

Audit logs record every request, whether it was allowed or refused, and who made it. Nothing can be edited or deleted from this record.

Use the filters at the top to narrow by user, result and date range (dates are in UTC), tick Full details to see the exact records involved, and use Export CSV to download the rows shown. A “pending confirmation” entry is not a rejection. It means the AI paused to ask before making a bulk change.

7. Settings you can change yourself

Back on the Dashboard you will find settings you can manage without contacting Cravit:

• Odoo connection: the Odoo address, database name and version the gateway connects to. Because changing this affects where your users' credentials are sent, you must enter a current code from your authenticator app to save it.
• Notification email: where notices about changes to your account are sent.
• Require IP allow-list: when on, administrators can only sign in from the network addresses you list. Turn it off if your office has no fixed IP address; two-factor authentication still protects the console either way.
• AI Prompt: company-wide guidance shown to the AI once a day per user, and again as soon as you change it. Useful for house rules, though it is guidance rather than enforcement. Use Roles for anything that must be enforced.

8. Signing in from now on

On later visits, after entering your tenant name and admin key you will simply be asked for the current 6-digit code from your authenticator app. You will not need to set up the app again.

Your session stays active if you refresh the page, and ends when you close your browser or click Sign out.

Using Cravit Gateway with Claude

This guide explains how to connect your Cravit Gateway account to Claude, so that Claude can read and, where you allow it, update records in your Odoo. Claude always acts as you, within the access your administrator has set up.

What connecting Claude actually does

Once connected, Claude can call a small set of tools against your Odoo, entirely through the Cravit Gateway:

• Search and read records you have access to.
• Create or update records, only if your administrator has given your account write access.

Claude never sees your Odoo password or API key. It only ever acts through your gateway key, which enforces exactly the access your administrator configured for you. If your role only allows reading, Claude cannot write, no matter what it is asked to do.

1. One-time setup for your organisation

This step is done once for your whole Claude organisation, by whoever manages it (a Claude Owner or Admin). If someone has already done this for your team, skip to step 2.

1. In Claude, go to Organization settings, then Connectors.
2. Click Add custom connector, then choose Web.
3. Give it a name (for example “Cravit Gateway”) and paste your gateway's MCP address.
4. Leave the OAuth Client ID and Client Secret fields under Advanced settings empty. The gateway registers itself with Claude automatically the first time someone connects.
5. Click Add. The connector now appears for everyone in the organisation. Each person still connects individually with their own key in the next step.

2. Connecting your own account

Everyone who wants to use Claude with Odoo does this step individually, using their own gateway key. Your key is personal. Do not share it with a colleague; ask your administrator to create their own instead.

1. In Claude, go to Settings, then Connectors.
2. Find Cravit Gateway in the list and click Connect.
3. A page opens asking for your gateway key. Paste the key that starts with cgw_.

   

4. Click Authorize. You'll be returned to Claude, now connected.

3. Using it in a conversation

Custom connectors are enabled per conversation, not permanently on:

1. Start a new chat in Claude.
2. Click the + button near the message box, then Connectors.
3. Turn on Cravit Gateway for this conversation.
4. Ask Claude what you need.

A few starting prompts:

• “Look up the contact details for [company name] in Odoo.”
• “List my open opportunities closing this month.”
• “Update the phone number on this contact to [number].” (only if your role allows writing)

If something doesn't work

• Claude can't connect, or the key is rejected. Check you copied the whole key, with no extra spaces, and that it hasn't been rotated or revoked since you received it.
• Claude says a change isn't allowed. That is the access control working as intended. Ask your administrator to review your role if you believe it is incorrect.
• The connector doesn't appear in your list. It needs to be added at the organisation level first (step 1); ask whoever manages your Claude organisation.
• You're not sure which MCP address or tenant name to use. Your administrator has both; they are the same details used to sign in to the admin console.

Using Cravit Gateway with ChatGPT

This guide explains how to connect your Cravit Gateway account to ChatGPT, so that ChatGPT can read and, where you allow it, update records in your Odoo. ChatGPT always acts as you, within the access your administrator has set up.

What connecting ChatGPT actually does

• Search and read records you have access to.
• Create or update records, only if your administrator has given your account write access.

ChatGPT never sees your Odoo password or API key. It only ever acts through your gateway key, which enforces exactly the access your administrator configured for you. Bulk changes pause for your confirmation before anything is saved.

1. Turning on Developer Mode

ChatGPT keeps custom connectors behind a setting called Developer Mode. This is a one-time toggle on your own account.

1. In ChatGPT, open Settings.
2. Go to Apps & Connectors, then Advanced settings.
3. Turn on Developer mode.
4. ChatGPT shows a warning about unverified connectors. This is standard for any custom connector. Review it and confirm.

2. Adding the connector

With Developer Mode on, add Cravit Gateway as a custom connector. This is done once per person.

1. In ChatGPT, open Settings, then Apps & Connectors.
2. Click Create (this may also say Add custom connector, depending on your plan).
3. Fill in the details:

   Name	Cravit Gateway
   MCP server URL	https://yourcompany.cravitgateway.com/mcp
   Authentication	OAuth

   ChatGPT detects OAuth automatically from the gateway, so you don't need a client ID or secret.
4. Confirm that you understand this is a custom, unverified connector, then click Create.
5. ChatGPT opens the gateway's sign-in page. Paste the gateway key that starts with cgw_ and click Authorize.

   

   This is the same sign-in page for every AI assistant that connects to the gateway, and it works the same way for each.

3. Using it in a conversation

1. Start a new chat in ChatGPT.
2. Open the tools or connector picker in the message box.
3. Turn on Cravit Gateway for this conversation.
4. Ask ChatGPT what you need, for example “Find all open sales orders for [customer]”.

If something doesn't work

• You don't see Developer Mode, or Create / Add custom connector. You may be on the Free plan (not supported), or your workspace admin needs to enable custom connectors first.
• ChatGPT can't connect, or the key is rejected. Check you copied the whole key, with no extra spaces, and that it hasn't been rotated or revoked.
• ChatGPT says a change isn't allowed. That is the access control working as intended. Ask your administrator to review your role.

Using Cravit Gateway with Microsoft 365 Copilot

This guide explains how your organisation connects Cravit Gateway to Microsoft 365 Copilot, so that Copilot can read and, where allowed, update records in your Odoo.

Connecting Copilot is more involved than connecting Claude or ChatGPT, and requires your Microsoft 365 administrator. This guide is written for that administrator, with a short section at the end for the people who will use it afterwards.

How this differs from Claude and ChatGPT

With Claude and ChatGPT, each person connects their own key inside the AI product. In Microsoft 365, the connector is set up once by IT, and the OAuth app registration lets Microsoft's platform hand each person's own sign-in through to the gateway. People still each need their own Cravit gateway key; they are just not the ones adding the connector.

Copilot never sees anyone's Odoo password or API key, and only ever acts through each person's gateway key and role.

1. One-time setup (IT administrator)

Microsoft offers two places to add an MCP connector: Copilot Studio, for organisations building a custom agent, and Microsoft 365 Copilot connectors, for the everyday Copilot chat. This guide covers the second, more common case.

1. In the Microsoft 365 admin center, go to Copilot, then Connectors.
2. Open the Gallery tab, and under “Created by your org” select Create a new connector.
3. Choose Connect to MCP server.
4. Enter the gateway's MCP address.
5. Microsoft requires an OAuth registration ID at this point, matching an app you register beforehand in the Teams Developer Portal. Contact Cravit for the exact redirect URL and endpoint details your registration needs.
6. Save the connector, then roll it out to the users or groups who should have it.

2. For people using it

1. In Microsoft 365 Copilot, find Cravit Gateway among your available connectors (typically the Connectors panel in Copilot or in Teams).
2. Choose to connect it, and you'll be sent to the gateway's sign-in page.
3. Paste your own Cravit gateway key, the one starting cgw_, and click Authorize.

   

   This is the same sign-in page for every AI assistant that connects to the gateway, and it works the same way for each.

4. Ask Copilot what you need, for example “Find all open sales orders for [customer]”.

If something doesn't work

• You can't find the connector. It needs to be added and rolled out by your administrator first.
• The sign-in step fails, or loops back without connecting. This usually points to the OAuth app registration, not your own key. Pass it to your administrator; it needs to be fixed centrally.
• Copilot says a change isn't allowed. That is the access control working as intended. Ask your administrator to review your role in Cravit.

Getting help

If you are locked out, have lost your admin key, need something changed that isn't in these guides, or run into trouble connecting an AI assistant, contact Cravit through cravit.nl and we will help. For day-to-day issues like a lost gateway key, contact your own administrator first.