Ramp manages corporate spend, cards, and finance workflows. Use Ramp OAuth for a user-delegated connection or an approved service credential for a named, least-privileged automation identity.
This guide prepares Ramp for an MCP client. The Ramp agent template is separate from Ramp-side authorization.
Choose a connection method
Choose OAuth when the connection should act for an approved Ramp user. Choose a service credential only when Ramp makes that option available for the organization's plan and a finance owner approves a shared integration. Ramp's authorization documentation describes the available OAuth setup.
Recommended: Approved OAuth or integration credential
Start with a dedicated Ramp test or least-privileged finance identity. Ask a Ramp administrator to approve the integration and its account/entity boundary before authorizing it.
- Register the OAuth/integration application in Ramp if the server requires client registration, using the exact callback URL supplied by the MCP client. For Dome, use
https://api.domesystems.ai/oauth/callback. - Request read-only transaction, card, or expense access for the initial setup.
- Complete any company-admin approval and authorize the dedicated identity.
- Read one known test expense or transaction.
- Confirm that payments, card controls, reimbursements, and unrelated entities are not available unless separately approved.
Alternative: Service credential
Where Ramp provides an API or service credential for your plan, issue it to a named integration owner, limit it to the necessary entities and scopes, and store it in secret storage. Rotate it when ownership or access requirements change.
- Open Ramp's OAuth authorization documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify Ramp MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Ramp MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Ramp boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
An authorization failure can be an organization integration-policy decision, not a client failure. Correct access with the finance administrator; do not use an owner credential as a general workaround.
Next steps
Deploy the Ramp agent template to create a governed agent in Dome that can work with the approved spend and finance boundary, with the template's included model, tools, and rules.
