How do I connect Claude to Clio?

Install the Clio MCP connector. Create a private developer application in Clio's developer portal at developers.clio.com to get a Client ID and Client Secret, add one JSON block to your Claude Desktop config pointing at the connector, restart Claude Desktop, then type 'authenticate with Clio' in a new conversation. The whole process takes about 15 minutes. The connector runs locally on your machine, so your Clio data does not pass through a third-party server.

What redirect URI should I use for the Clio developer application?

Exactly http://127.0.0.1:5678/callback. Not localhost, and no trailing slash. Clio matches the redirect URI exactly against what you registered, so 127.0.0.1 and localhost are treated as different values even though they resolve to the same machine. A mismatch here is the single most common reason the OAuth login fails.

Which Claude plan should a law firm use with Clio MCP?

Not a consumer plan, if you are handling privileged client material. Consumer terms permit the provider to use your inputs, which is the wrong footing for attorney-client privileged content. The defensible configuration is enterprise-tier Claude or the Claude API with training disabled and zero data retention. Claude Pro and Max are appropriate for non-privileged exploration only.

What are Clio's API rate limits?

Clio's API has a default rate limit of 50 requests per minute during peak hours, defined as 04:00 to 19:00 Pacific Time, Monday to Friday. Limits are applied per access token and are higher off-peak. Clio does not offer custom rate limit increases. This matters in practice: it means a request that asks Claude to sweep hundreds of matters at once will be throttled, so scope your first workflows accordingly.

Clio MCP Setup Guide: Connect Claude to Clio in 15 Minutes

Q: Do I need to contact Clio support to get API access?

No. For a firm building an integration for its own use, Clio calls this a private app and it requires no review or approval. In Clio's own words, private apps for Clio Manage are not reviewed by Clio and cannot be published in Clio's App Directory. You create it yourself at developers.clio.com. This differs from MyCase, where you must request OAuth credentials from support and wait several business days.

Q: Which Clio plan do I need for API access?

Clio's developer documentation states that apps and integrations, including private apps, are not available on the EasyStart pricing tier. That is the only tier Clio names as excluded. Advanced and Complete include API access. If you are on Essentials, check your own account before you start: open developers.clio.com and see whether you can create a developer application. Do not rely on third-party pricing blogs for this answer.

Q: Can the Clio MCP connector write to Clio, or is it read only?

It can write. As of v2.0.1 the connector can create matters, notes, tasks, calendar entries and time entries, and upload documents, alongside its read tools. There is no read-only configuration flag today. What stands between Claude and a write is Claude Desktop's own approval prompt, which asks you before each action. If you want a hard guarantee that nothing can be written into your practice management system, that guarantee does not currently exist at the connector level, and you should know that before you point it at live matters.

Check this before you do anything else

Clio does not allow integrations on its entry-level plan. From Clio's own developer documentation: apps and integrations, including private apps, are not available on the EasyStart pricing tier.

EasyStart is the only tier Clio names as excluded. Advanced and Complete include API access. If you are on Essentials, we cannot give you a confident answer, and neither can the third-party pricing blogs that claim to. Open developers.clio.com, sign in, and see whether you can create a developer application. That takes ten seconds and it settles the question for your account specifically.

Do this first. It is the cheapest possible way to find out that this project is not going to work.

What you need

Clio Manage. The connector is built against the Clio Manage v4 API. Clio Grow is not supported.
Clio administrator access, so you can create a developer application.
Node.js 18 or later.
Claude Desktop, and a machine to run it on. The connector runs locally as a child process. It is not a hosted service.
A decision about which Claude plan you are on. This is not a formality and we come back to it below.

Step 1: Create a Clio developer application

You do not need to contact Clio support for this, and you do not need anyone's approval. A firm building an integration for its own use is creating what Clio calls a private app. In Clio's words: private apps for Clio Manage are not reviewed by Clio and cannot be published in Clio's App Directory. It exists only for your account.

This is worth stating plainly because the neighbouring product works differently. With MyCase you must request OAuth credentials from support and wait, in our case, thirteen business days. Clio is self-serve and takes about two minutes.

Go to developers.clio.com, sign in with your normal Clio login, then Developer Apps → Add.

Trap 1. Older guides, including earlier versions of our own README, tell you to go to Settings → Developer Applications inside the Clio app. That path is stale. Use the developer portal.

Step 2: The redirect URI has to be exact

Name the app whatever you like. The field that matters is the redirect URI:

http://127.0.0.1:5678/callback

Trap 2. No trailing slash. Not localhost. It must be 127.0.0.1. Clio matches the redirect URI as a literal string against what you registered, so localhost and 127.0.0.1 are different values to Clio even though they are the same machine to you. This one mismatch is the most common reason the login fails, and the error message does not tell you why.

Save the application. Clio shows you a Client ID and a Client Secret. The secret is displayed once. Copy both now.

These are credentials to your practice management system. Do not email them to anyone, including us.

Step 3: Point Claude Desktop at the connector

Open your Claude Desktop configuration file:

Mac: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Add this inside the "mcpServers" section, substituting your own credentials:

{
  "mcpServers": {
    "clio": {
      "command": "npx",
      "args": ["-y", "@oktopeak/clio-mcp"],
      "env": {
        "TRANSPORT": "stdio",
        "CLIO_CLIENT_ID": "your_client_id",
        "CLIO_CLIENT_SECRET": "your_client_secret"
      }
    }
  }
}

You do not need to clone the repository or build anything. The package is published to npm and npx fetches it for you.

Trap 3. "TRANSPORT": "stdio" is not optional. From v2.0.0 the connector defaults to HTTP mode. If you omit this line, the install fails with an error that does not point at the cause. Every guide written before v2 omits it.

If the file already has other MCP servers in it, add a comma after the previous entry before pasting the "clio" block. A missing comma in this file is a JSON syntax error and Claude Desktop will simply not load the connector.

Outside the US? If your firm is on Clio EU, Canada or Australia, you also need to override CLIO_API_BASE, CLIO_AUTH_URL and CLIO_TOKEN_URL with your regional endpoints. The defaults are US.

Step 4: Restart, then authenticate

Quit Claude Desktop completely and reopen it. Then, in a new conversation:

authenticate with Clio

Claude opens your browser to Clio's login page. Log in as normal. When you see Authentication successful, go back to Claude. To confirm:

check my Clio auth status

You should see your Clio user ID and a token expiry time. Your OAuth tokens are encrypted with AES-256-GCM and stored in your operating system's keychain. They stay on your machine.

On Windows, expect three specific errors

Windows installs hit failure modes that Mac installs do not, and they are the same three we documented for our MyCase connector. They apply identically here.

Could not attach to MCP server, caused by invoking npx directly. The fix is a cmd /c npx wrapper.
UNABLE_TO_VERIFY_LEAF_SIGNATURE, caused by corporate antivirus doing SSL inspection. This is common at law firms specifically. The fix is NODE_OPTIONS=--use-system-ca.
OAuth port mismatch, where the port in your config and the port in your Clio redirect URI disagree.

The full fixes are in our Windows install guide. It is written for MyCase MCP, but every Windows fix in it applies to Clio MCP unchanged.

What it can actually do, including what it can write

The connector exposes 26 tools. It reads matters, contacts, documents, tasks, calendar entries, time entries, users and billing summaries.

It also writes. As of v2.0.1 it can create matters, notes, tasks, calendar entries and time entries, and it can upload documents.

We want to be precise about what guards that, because it matters more in a law firm than almost anywhere else. There is no read-only configuration flag today. What stands between Claude and a write is Claude Desktop's own approval prompt, which asks you before each action. That is a real control and most people click it thoughtfully. It is also a prompt that a tired associate can click through at six in the evening.

If you want a hard guarantee that nothing can be written into your practice management system, that guarantee does not currently exist at the connector level. Know that before you point it at live matters. If read-only is a requirement for your firm, tell us and we will tell you honestly where that stands.

Every tool call, read or write, is recorded in an append-only audit log aligned with ABA Formal Opinion 512. Of the four open-source Clio MCP servers, this is the only one that ships that.

Clio will throttle you at 50 requests per minute

Clio's API allows 50 requests per minute during peak hours, which they define as 04:00 to 19:00 Pacific, Monday to Friday. Limits are per access token and are more generous off-peak. Clio does not grant custom increases.

This has a practical consequence people discover the hard way. Asking Claude to sweep every open matter and summarise it will hit the ceiling. Scope your first workflow to something bounded: one matter, one client, one date range. The connector is excellent at answering a specific question against your real data and it is not a bulk export tool.

The plan question you have to answer before you touch matter data

Connecting the plumbing is the easy part. The decision that actually matters is which Claude you connect it to.

Consumer plans permit the provider to use your inputs. For privileged client material that is the wrong footing, and it is not a theoretical concern. In February 2026 Judge Rakoff in the Southern District of New York held that a defendant's exchanges with a consumer AI tool were not privileged, in part because the provider's privacy policy allowed it to use those inputs. Other district courts have gone the other way in civil matters, so the law is genuinely unsettled. That is exactly the reason to be deliberate rather than relaxed about it.

The defensible configuration is enterprise-tier Claude or the Claude API with training disabled and zero data retention. Claude Pro and Max are for non-privileged exploration only.

We wrote up the full comparison, including why Enterprise's seat minimum makes it the wrong answer for a small firm: which Claude plan should a law firm use.

One thing we will not tell you, because it is not true: that nothing leaves your firm. With any hosted model, matter content goes to the provider for inference. Anyone who tells you otherwise is selling you something. The only architecture where nothing genuinely leaves is a local model, and if that is what your firm requires, that is a real option and we build those too.

If the config file is not your idea of an afternoon

The steps above assume you are comfortable editing a JSON file and reading an error log. Plenty of firms are not, and there is no shame in that. A two-person firm should not be spending a Saturday on antivirus SSL inspection errors.

We deploy this for firms: scoped OAuth credentials, the audit log wired into your stack so ABA 512 is satisfied on day one, one workflow designed and tested with your team, and training for whoever will own it. You keep the code either way. It is open source and you can read every line before you decide anything.

Book a 30-minute call and we will tell you whether this is worth doing for your firm, including if the answer is no.