This guide walks you through setting up the connection and what to do if it doesn't work first time.
A working connection depends on four things:
Network access: Legora can reach the Legatics hostnames
A Connected App in Legatics: a System Admin sets this up so Legora can sign in on your behalf
The right settings in Legora: the MCP server URL and client ID from your Connected App
Write access (optional): switched on if you want Legora to create or update rows
Before you start
Gather these first. Where setups have been delayed, one of them was usually missing.
What you'll need | Where it comes from | Why it matters |
Your Legatics MCP server URL | Legatics (see Finding your Legatics API and MCP URLs) | The URL differs by region (for example, mcp.eu1.legatics.com for EU environments) |
A Legatics System Admin | Your firm | Only a System Admin can create the Connected App that authorises Legora |
A Connected App for Legora, and its client ID | Your System Admin, in the Legatics Administration System | Legora uses this to sign in to Legatics. We're happy to help you set it up |
Admin access to Legora's MCP settings | Your firm | This is where you enter the server URL and client ID |
A contact at Legora who manages allowlisting | Your firm | Legora may block connections to hosts it hasn't approved yet |
A Legatics account with access to the matters you want to use | Your firm | Legora only ever sees what that account can see in Legatics |
Important: Legatics has multiple Instances, each with its own URL. Matters and users aren't shared between Instances, so make sure the MCP server URL matches the Instance (and region) that hosts your matters.
Setting up the connection
This is the order that has worked well for firms so far. Your setup may need some steps in a different order, or a few extra ones.
Step 1: Check allowlisting with Legora
Legora may need to allowlist the Legatics hosts before it can connect. Ask your Legora contact to allowlist:
The Legatics MCP server (for example, mcp.eu1.legatics.com)
The Legatics authentication host (api.app.legatics.com)
Tip: Allowlist by hostname rather than IP address. Our endpoints sit behind Cloudflare, so IP addresses can change.
Step 2: Create a Connected App in Legatics
A System Admin creates this in the Legatics Administration System (see Create and manage connected apps). Use these settings:
Redirect URI: https://app.eu.legora.com/mcp-server-oauth (this may differ by region)
Client type: public client with PKCE (S256), with no client secret
Scope: legatics_mcp, plus write scopes if you want Legora to make changes
Copy the client ID once the app is created. You'll need it in the next step.
Step 3: Add the MCP server in Legora
Open Legora's MCP settings.
Enter your Legatics MCP server URL.
Enter the client ID from your Connected App.
Leave the client secret blank.
Note: Legora connects as a public client, so it doesn't need a client secret. Entering one can cause sign-in to fail.
Step 4: Connect and sign in
Start the connection in Legora.
In the Legatics sign-in window, sign in with your Legatics account.
Review the permissions and approve access.
You can narrow what Legora is allowed to do at this point, but you can't widen it beyond what the Connected App allows.
Note: Connections start as read only. To let Legora create or update rows, untick Read only in Legora.
Having trouble?
Find the stage where the connection stops, then work through the issues for that stage. The most common causes are listed first.
The connection fails before a sign-in window appears
This is usually down to network access or the MCP server URL itself.
What you see | Likely cause | What to do |
The connection fails straight away | Legora can't reach the MCP server yet | Ask Legora whether the MCP server hostname is allowlisted for your workspace |
Legora asks for an IP address to allowlist | Our endpoints don't use fixed IP addresses | Share the hostnames instead and explain they sit behind Cloudflare |
"Failed to fetch protected resource" | Legora can't read the server's sign-in details. The URL may be slightly off | Check the MCP URL character by character (region, https, any path or trailing slash) against the one we sent you |
The same error after we've made a fix | A cached setting or old connection in Legora | Remove the MCP server in Legora and add it again from scratch |
Errors only for some people or offices | Your firm's firewall or web proxy may be blocking a host | Ask your IT team to check outbound access to the Legatics hostnames |
Sign-in doesn't complete
If the sign-in window opens (or should open) but sign-in doesn't finish, the issue is usually the Connected App setup or your browser settings.
What you see | Likely cause | What to do |
A 500 error as sign-in starts (sometimes on a getMcpOAuthMetadata request) | Legora can reach the MCP server but not the authentication host | Ask Legora whether api.app.legatics.com is allowlisted too |
No sign-in window opens | A pop-up blocker or browser extension | Allow pop-ups for Legora, or try a private window or another browser |
A registration or "invalid client" error | No Connected App exists yet, or the client ID has a typo | Ask your System Admin to check the Connected App, then copy the client ID into Legora again |
"Redirect URI mismatch" or similar | The redirect URI on the Connected App doesn't exactly match Legora's | Check the region in the URI (for example, eu or us) and update the Connected App to match |
The token exchange is rejected | The Connected App is set up as confidential (expecting a secret) rather than public with PKCE | Ask your System Admin to check the client type, and make sure no client secret is entered in Legora |
Sign-in works but then loops or times out | Your firm's single sign-on or session settings | Sign in to Legatics in another tab first, then retry from Legora |
Note: If your firm uses SSO, sign-in loops and time-outs are often caused by your identity provider's session settings. Your internal IT team can check these.
Something doesn't work once you're connected
If you can connect and sign in but something doesn't work as expected, the issue is usually permissions, scopes or the state of the Connected App.
What you see | Likely cause | What to do |
You can read data but can't create or update rows | The Connected App may include the read_only scope, or Read only may be ticked in Legora | Untick Read only in Legora to allow write actions |
Writes don't work on an older setup | Connected Apps created before write access went live don't get it automatically | Ask your System Admin to update the Connected App's scopes |
Fewer actions than you expected | You may have approved a narrower set of permissions at sign-in | Disconnect, reconnect and review what you approve |
Writes fail on a particular list or matter | Your Legatics account may not have edit rights there | Check your role on the matter. The connection can't do more than you can |
A matter you expect isn't showing | Your Legatics account isn't on that matter | Check you have access in Legatics, or try a different account |
Large updates are slow or partly fail | Writes currently happen one row or cell at a time | Try a smaller batch first, and talk to us about larger volumes |
It worked before and has now stopped | Sign-in tokens are short-lived, or the Connected App may have been revoked or changed | Disconnect and reconnect in Legora, and ask your System Admin whether the app is still active |
General tips
Check whether the issue is Legora-specific. If you have another MCP client, connect it to the same Legatics server. If that works, the issue is more likely in the Legora setup.
Ask Legora to check their logs. Legora can often see which URL failed and why, which helps us narrow things down quickly.
Confirm Legora's support for custom MCP connections. Custom connections may behave differently on newer versions of Legora, so check current behaviour with your Legora contact.
Bring both sides together. A short call with your team, Legora and us often resolves issues faster than email. We're happy to join.
Still stuck?
If you've worked through these steps and the connection still isn't working, contact us at support@legatics.com with:
The exact MCP URL you entered in Legora
The date and time of the connection attempt, with your time zone
The full error message
If Legora can share it, the URL that failed and its HTTP status code
Screenshots of your MCP settings in Legora
This lets us trace the attempt in our logs quickly. We're also happy to set up a short call with your team, and with Legora if useful, to work through it together.
For firewall, web proxy or SSO issues, contact your internal IT team first.