Connect Open WebUI
Connect your own Open WebUI installation to LoanMonitor: register it once, enter the values in Open WebUI, and let every employee sign in with their own account.
Open WebUI is a chat interface you run yourself, on a server or as the Open WebUI Desktop app. Connected to LoanMonitor, its assistant can read your loans and, if you allow it, change them. Every person signs in with their own LoanMonitor account, so the assistant sees exactly what that person sees in LoanMonitor.
This guide follows Open WebUI 0.11. Older versions may name some fields differently. The exact values for your account are on the MCP page in LoanMonitor (Settings → Access → MCP, tab Self-hosted chat), ready to copy.
What you need
- A customer admin in LoanMonitor, who registers your Open WebUI installation once. One entry per installation, not one per employee.
- An Open WebUI admin, who adds the connection in Open WebUI.
- Network access: the Open WebUI server itself must reach
api.loanmonitor.euandauth.loanmonitor.euover HTTPS. A VPN changes nothing as long as this works.
1. Register the instance in LoanMonitor
In LoanMonitor, open Settings → Access → MCP, tab Self-hosted chat, and click Register instance:
| Field | What to enter |
|---|---|
| Name | A label for you and your colleagues, for example Open WebUI Finance. It appears on the sign-in consent screen as "your company · name". |
| Frontend | Open WebUI |
| Address of the instance | The address in the browser bar when you use Open WebUI, for example https://chat.example.com (with a path prefix if you use one). https is required; http is allowed only for localhost and 127.0.0.1. |
| Connection ID in Open WebUI | Default loanmonitor. You type the same ID in Open WebUI in step 2. |
The dialog shows the resulting callback URL, for example https://chat.example.com/oauth/clients/mcp:loanmonitor/callback. LoanMonitor accepts sign-ins only for this exact address. In Open WebUI, Admin Panel → Settings → General → WebUI URL must be the same address you registered, because Open WebUI builds its callback URL from it.
After Register, LoanMonitor shows the client secret of the instance once. Copy it right away; you need it in step 2. LoanMonitor does not keep it and cannot show it again. If it is lost, click New secret next to the instance: the old secret stops working at once, and you enter the new one in Open WebUI.
2. Add the connection in Open WebUI
In Open WebUI, open Admin Panel → Settings → Integrations and add a connection of type MCP (Streamable HTTP):
| Open WebUI field | Value |
|---|---|
| URL | https://api.loanmonitor.eu/mcp (the field shows the placeholder API Base URL) |
| ID | the connection ID you registered (default loanmonitor) |
| Auth | OAuth 2.1 (Static) |
| Client ID | the client ID shown next to your instance on the MCP page |
| Client Secret | the client secret shown once at registration |
| OAuth Server URL | leave empty |
| OAuth Scopes | openid profile email offline_access loans:read loans:write |
| OAuth Resource Parameter | Automatic |
OAuth Server URL is not the callback URL. Leave it empty: Open WebUI finds the LoanMonitor sign-in server from the URL above and builds the callback URL itself.
Type the scope list in full. The default Open WebUI discovers does not contain openid and offline_access, and without offline_access everyone has to sign in again every hour.
Click Register Client. The badge next to it must change from Not Registered to Registered.
Click Save.
Reload Open WebUI (or restart the desktop app). Open WebUI loads its tool list when the page loads, so a new connection appears in the chat only after a reload.
3. Use it (every employee)
In a chat, click the Integrations icon to the right of +. It is a button of its own, not an entry in the + menu.
Open Tools and enable LoanMonitor.
The first time, your browser opens the LoanMonitor sign-in. Sign in with your own LoanMonitor account.
The consent screen names your company and the instance. Allow Read loans and, if the assistant should make changes, Write loans.
Ask, for example: "List my loans."
Open WebUI Desktop
The desktop app runs Open WebUI on your own computer, usually at http://127.0.0.1:8080. Register exactly that address in step 1, and open Open WebUI under the same address. http://localhost:8080 is a different address for the sign-in, and the callback would not match.
Manage the instance
On the MCP page, tab Self-hosted chat, a customer admin can:
- Edit the name, the address or the connection ID. Change the WebUI URL and the ID in Open WebUI to match.
- Create a New secret. The previous secret stops working immediately, so enter the new one in the Open WebUI connection right away.
- Revoke the instance. Sign-ins through it stop working, and sessions already open are refused on their next request.
An instance registered before LoanMonitor issued client secrets shows the note "This instance has no client secret". Revoke it and register the instance again; you get a new client ID and a secret.
Troubleshooting
| Problem | What to do |
|---|---|
| "Please enter a valid URL" | The URL field (placeholder API Base URL) is empty. Enter https://api.loanmonitor.eu/mcp. |
| "Connection failed" or "Registration failed" | Check that the URL is https://api.loanmonitor.eu/mcp, that OAuth Server URL is empty, and that the client secret is filled in. |
| "Please enter Client ID and Client Secret" | Enter the client secret from the registration. Lost it? Create a New secret on the MCP page. |
| No Integrations icon in the chat | Reload Open WebUI or restart the desktop app. Check that the connection is switched on. |
| Other users do not see LoanMonitor | Admins see the tool automatically. Give other users or groups access with Access Control on the connection. |
| Sign-in fails with a redirect or callback error | The address you open Open WebUI under, the WebUI URL setting and the registered address must be the same, including 127.0.0.1 versus localhost. |
| "invalid_client" after sign-in | The client secret is wrong or was replaced. Enter the current secret, or create a new one. |
Questions
Do we need one entry per employee? No. One entry per Open WebUI installation. Every employee signs in individually.
Which rights does an employee have? Exactly their LoanMonitor rights: the same customers, locations and permissions as in the LoanMonitor web app. If they work for several customers, the assistant only sees the customer this instance is registered for.
Our instance has two addresses (for example an internal and an external hostname). Register it with the frontend type Other and list both callback URLs, or change the address of the entry when you move.
More about connecting assistants: Connect AI Assistants (MCP). Still stuck? Write to support@loanmonitor.eu. Never send a client secret by email.
Connect AI Assistants (MCP)
Use Claude, ChatGPT and other AI assistants with your LoanMonitor data: the two ways to connect, what each needs, and how to set it up.
Single Sign-On (SSO)
Let your team sign in to LoanMonitor with your company account (Microsoft Entra ID, Okta, Google Workspace and more). What SSO gives you and what we need to set it up.