Skip to main content
Connections are added inside an Access bundle. At claude.ai/admin-settings/claude-tag, open Access bundles in the left navigation, click into a bundle (or Create one), and go to its Credentials tab.
Connecting Amplitude lets Claude answer product-analytics questions, such as funnel and retention numbers, event segmentation, a user’s recent activity, and cohort sizes, from any channel under the bundle’s scope. You add it as a connection inside an Access bundle; the credential belongs to the agent, not to any person. You can connect with a project API key and secret key, which you can limit to read requests, or by signing in as an Amplitude user, which gives Claude Amplitude’s MCP tools for creating and editing content as well as reading it. For the API key route, pair the connection with a plugin that covers Amplitude so Claude knows how to call the REST API; see Attach plugins. A member’s own Amplitude connector on claude.ai is separate from this connection and applies in DMs. In organizations where personal connectors in channels is available, Claude can also use that connector in a channel for that member’s own tasks, after the member allows it.

​
Choose an API key or Amplitude sign-in

On a bundle’s Credentials tab, clicking Connect next to Amplitude opens a form that offers two ways to connect: Sign in with Amplitude, selected by default, and Use an API token below it. Use the API key route when Claude should be limited to read requests. Also use the API key route when Amplitude hosts your organization’s data in its EU data center (you sign in to Amplitude at app.eu.amplitude.com rather than app.amplitude.com), because the Sign in with Amplitude option connects to the MCP server for Amplitude’s US data center, https://mcp.amplitude.com/mcp. Choose Amplitude sign-in when Claude should also build or change content in Amplitude, such as creating a chart or updating a dashboard. With either route, Claude can use the connection in every channel under the bundle’s scope. The form calls the sign-in option an MCP connector because Claude reaches Amplitude through Amplitude’s hosted MCP server, and the result is still a connection in the bundle, not a personal claude.ai connector.

​
Get the API key and secret key from Amplitude

The API key route uses two keys from one Amplitude project: the project’s API key and a secret key. The connection sends them with HTTP Basic authentication, the API key as the username and the secret key as the password. Keys belong to a single project, so each connection reaches one project’s data, and an organization with several Amplitude projects needs a key pair and a connection for each. You need the Manager or Admin role in Amplitude to generate keys. Generate a secret key dedicated to this connection and give it a name that identifies Claude, so you can rotate or revoke it without affecting the keys your other tools use. Amplitude shows the secret key’s value only once and can’t display it again, so copy it as soon as it appears; if you lose it, generate a new secret key. An Amplitude key pair has no read-only option, and the same pair can also call Amplitude’s write and user-deletion endpoints. In the next section you restrict the connection to GET requests, so the key pair authenticates read requests only. Read access still covers everything those APIs return for the project, including raw event export and individual users’ event streams, so scope the bundle to channels whose members may see that data. Amplitude’s own guide for creating the keys is at amplitude.com.

​
Add the connection with an API key

A saved connection is live with every HTTP method in any channel under the bundle’s scope. Add the connection to a bundle that isn’t attached to a scope yet, and attach the bundle after you finish the restriction step below.
1

Open the Amplitude form

On the bundle’s Credentials tab, click Connect next to Amplitude.
2

Enter the key pair

Select Use an API token, then fill in the two fields.The host is prefilled as amplitude.com. If Amplitude hosts your organization’s data in its EU data center (you sign in to Amplitude at app.eu.amplitude.com rather than app.amplitude.com), replace the host with analytics.eu.amplitude.com.Click Connect to save the connection.
3

Restrict the connection to read requests

The connection is created with the /api/ path prefix, which covers Amplitude’s REST APIs and keeps the key pair off the rest of amplitude.com. Add the method restriction yourself: select Edit on the connection’s row, then in the Edit connection dialog clear All methods under Methods and select GET. See Restrict by path or method.With the restriction in place, the Agent Proxy attaches the key pair only to GET requests under /api/. A request outside that restriction, such as a write or a user-deletion call, doesn’t match the connection. Agent Proxy never attaches the key pair to it, so the request can’t authenticate to Amplitude.
Amplitude rate-limits these APIs per project, with a cap on concurrent requests and an hourly budget in which queries that span more days or segments cost more. Claude’s queries draw on the same budget as your project’s other API clients. If Claude reports that Amplitude returned a rate-limit error (HTTP 429), narrow the date range, drop a group-by, or ask again later. Amplitude’s Dashboard REST API documentation lists the current limits. The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See how Agent Proxy works.

​
Add the connection with Amplitude sign-in

Sign in as a dedicated Amplitude user created for this connection (for example, claude@yourcompany.example.com), not with your own account. Anyone in a channel under the bundle’s scope can ask Claude to use the connection, so everything that user can reach in Amplitude is available to every member of those channels. Because Amplitude’s MCP tools can create and edit charts, dashboards, and cohorts as well as read them, give the user the most limited role that covers what the channels need in each project, such as Viewer. A dedicated user also limits Claude to the projects you add that user to and keeps Claude’s activity in Amplitude traceable to one account.
This route connects to the MCP server for Amplitude’s US data center. If you sign in to Amplitude at app.eu.amplitude.com, Amplitude hosts your organization’s data in its EU data center, so use the API key route instead.
1

Open the Amplitude form

On the bundle’s Credentials tab, click Connect next to Amplitude.
2

Sign in as the dedicated user

Leave Sign in with Amplitude selected. The Sign in with Amplitude option shows the MCP server the sign-in grants access to, https://mcp.amplitude.com/mcp, and the form sets the connection’s allowed host to that server for you.Click Sign in with Amplitude at the bottom of the form. A sign-in window opens. If your browser blocks pop-ups, allow them for claude.ai and click Sign in with Amplitude again. Sign in to Amplitude as the dedicated user and approve access. When the sign-in completes and the window closes, the connection is saved to the bundle and appears on its Credentials tab.
Amplitude decides what the signed-in user can read and change, and that user’s roles and project access apply to every request Claude makes through this connection. The GET restriction described for the API key route applies only to that route’s key pair. If the sign-in succeeds but Claude reports that Amplitude denied a request, check the dedicated user’s role and project access in Amplitude. See Amplitude MCP for what Amplitude’s MCP server can do.

​
Verify the connection

In a channel under the bundle’s scope, in a new thread:
With either route, Claude replies with event types from Amplitude once the connection is live. New threads pick up the connection on their own; in an existing thread, ask Claude to use Amplitude by name.