---
name: connect-invoflux-mcp
description: Discover, authorize and connect to the Invoflux MCP server at mcp.invoflux.com over OAuth 2.1 with PKCE and dynamic client registration. Use when connecting an agent to Invoflux, or when an Invoflux tool call returns 401.
---

# Connect to the Invoflux MCP server

Invoflux is an invoice automation platform for European SMBs and their
accountants. It exposes one agent surface: a Model Context Protocol server over
Streamable HTTP that reads and acts on a single Invoflux workspace.

**Server URL:** `https://mcp.invoflux.com/mcp`

## When to use this

Use this skill when a user asks you to connect to Invoflux, when an Invoflux
tool call returns 401, or when you need to set up access before answering
questions about their invoices, suppliers or spending.

## Authorization

Standard OAuth 2.1: authorization code, PKCE with S256, dynamic client
registration, refresh tokens. There is no API key, and there is no machine-only
grant. A person approves the connection in a browser once.

Most MCP clients handle all of this for you. Point the client at the server URL
and let it run the flow. Only do the steps below by hand if your client does not
speak OAuth.

1. Call the server with no token. The 401 carries
   `WWW-Authenticate: Bearer resource_metadata="https://mcp.invoflux.com/.well-known/oauth-protected-resource"`.
2. Fetch that document for the authorization server, then fetch
   `https://mcp.invoflux.com/.well-known/oauth-authorization-server` for the
   endpoints. Read them from the document rather than hardcoding them.
3. Register at the `registration_endpoint`. Public clients with no secret are
   accepted as long as they use PKCE.
4. Send the user to the `authorization_endpoint` with `code_challenge` and
   `code_challenge_method=S256`, then exchange the code at the
   `token_endpoint` with your `code_verifier`.
5. Send the access token as `Authorization: Bearer <token>` on every call.

Full walkthrough, including the error table: https://invoflux.com/auth.md

## After connecting

Call `companies_list` first. Most Invoflux users run more than one company, and
nearly every other tool takes a `company_id`. A token grants access to exactly
the companies its user could already reach, and nothing more.

## Failure modes

- **Persistent 401 after a successful connection.** The user probably
  disconnected the agent from inside Invoflux. That is deliberate. Stop
  retrying and tell them to reconnect.
- **403 on a specific tool.** `accounting_clients_list`,
  `accounting_get_missing_across_clients` and `invoices_mark_reviewed` are
  accountant-only. Do not retry with a different company id.
- **429.** Back off and respect `Retry-After`.