Authentik is the company's Single Sign-On (SSO) system — one account logs you into Loom (and other tools that have finished Authentik linking). If you already have an Authentik account, skip to Step 2.
NDoc / Kanban note
NDoc still requires Sign in with Google first, then link Authentik in NDoc Settings — Authentik-only signup does not create an NDoc account. Kanban supports Authentik SSO (configured Aug 2026).
📩
Account request required
Authentik does not have an open registration page — you need to request an account from Jeff.
Contact Jeff and ask him to create your Authentik account. He will send you an enrollment link that looks like:
Contact Jeff and ask him to create your Authentik account. He will send you an enrollment link that looks like:
auth.prod.wellplay.io/if/flow/default-source-enrollment/?itoken=…
Contact Jeff to request your account
Message Jeff on Mattermost or via email and ask him to create an Authentik account for you.
Open the enrollment link and register
Click the enrollment link Jeff sends you. Fill in your name, email, and choose a password. The link is single-use — open it right away.
Verify your email
Check your inbox for a verification email and click the link to activate your account.
Why does it work this way?
Authentik is a private company identity system — open registration is disabled to prevent unauthorised access. Only approved team members can create accounts.
Open Authentik →
Already have an account? Click Next.
Now that you have your Authentik account, log into the Loom portal. Loom is your AI control centre — it's where you manage your tool connections and generate your AI token.
Click "Login with Authentik"
Use the button below or the one in the top-right corner. You'll be redirected to Authentik to sign in.
You're logged in!
You'll land on the Loom Dashboard. Your name will appear in the top-right corner. Come back to this guide to continue.
Your Loom account
All authenticated Authentik users automatically get member access — no admin approval needed.
NDoc, Kanban, and GitHub use OAuth — a secure one-time authorisation. Once connected, your AI assistant can read and write to these tools on your behalf.
Go to My Connections
After logging in, click My Connections in the top navigation bar.
Click "Connect" next to NDoc
A popup opens NDoc's OAuth page. If you have never used NDoc, create the account with Google first (then you can link Authentik in NDoc Settings). Authorise Loom and the popup closes automatically.
Click "Connect" next to Kanban
Repeat for Kanban — use Authentik SSO (configured Aug 2026). Each connection takes about 30 seconds.
Connect GitHub (optional)
Click Connect next to GitHub. You'll be redirected to GitHub's OAuth page to authorise access. Once connected, your AI can read repos, issues, PRs, and more.
What does "Connect" do?
Loom stores your personal OAuth token securely. When your AI calls a tool (e.g. read_page), Loom forwards the request using your own identity — so NDoc sees it as you, not a shared bot account.
Open My Connections →
Tip: You can return to this guide after connecting.
Memory is Naton Lab's private AI memory system. Unlike shared tools, each person's memory pool is completely private — only you can read and write to it. You need a personal API key to unlock it.
Open the Memory portal
Sign in (Authentik or OTP)
Prefer Sign in with Authentik if shown. Or enter your @naton.io email for a one-time password (OTP) and verify.
Copy your API key
Your API key is shown once on first login. Copy it immediately. (You can regenerate it later if needed — your memories are never affected.)
Paste it in My Connections
Back in Loom → My Connections, find the Memory card and click Set Key. Paste your key and save.
What can Memory do?
Memory lets your AI save notes, decisions, and context across sessions — and search them semantically later. You can also create Share Buckets to selectively share knowledge with teammates.
Mattermost is the company's chat platform. With your personal API key, your AI assistant can read messages, send replies, and search conversations — all as you, not a shared bot.
Open Mattermost
Go to chat.prod.wellplay.io and log in.
Open your Profile settings
Click your profile picture (top-right) → Profile → Security tab.
Create a Personal Access Token
Scroll to Personal Access Tokens → click Create Token → give it a name (e.g. "Loom AI") → click Save.
Copy and paste into Loom
Copy the token. Back in Loom → My Connections, find the Mattermost card and click Set Key. Paste and save.
What can the AI do with Mattermost?
Send DMs, read channels, search conversations, create posts, and get team info — all on your behalf. Perfect for asking your AI to summarise a discussion or draft a message.
The final step — generate your personal AI token and connect your AI tools. After this, your AI assistant will have access to all the tools you set up.
Go to AI Config
Click AI Config in the top navigation bar. This is where you generate your token and copy config snippets for each AI tool.
Choose validity and generate your token
Under Token Validity, pick how long your token should last (7 days · 30 days · 1 year · Unlimited). Click ↻ Generate New Token and confirm the modal. Generating a new token immediately invalidates the previous one.
Copy the config for your AI tool
In Cursor: copy the MCP snippet → paste into
In Claude Desktop (the app — not claude.ai in a browser): needs Node.js. Copy the Claude Desktop snippet, then fully quit & reopen — Claude logs you in via OAuth automatically.
In Claude Code / Codex: copy the relevant snippet from the AI Config page.
In Open WebUI: MCP via OAuth on
~/.cursor/mcp.json.In Claude Desktop (the app — not claude.ai in a browser): needs Node.js. Copy the Claude Desktop snippet, then fully quit & reopen — Claude logs you in via OAuth automatically.
In Claude Code / Codex: copy the relevant snippet from the AI Config page.
In Open WebUI: MCP via OAuth on
llm.os.wellplay.io; optional model brain via /v1 — see Step 7.
Mattermost Personal Bot (optional)
Do not use a
/connect DM anymore. Go to My Connections → Personal Bot: paste your Mattermost bot token + username, pick tool permissions and a Reply model (from AI Models), then create. Loom pushes config to Bot Server for you.Verify the connection
On the AI Config page, click 🔌 Test MCP Connection. You should see: ✓ MCP connection OK. In Cursor, ask your AI "what tools do you have?" to confirm Loom is active.
Token renewal & invalidation
You choose how long your token lasts — from 7 days to Unlimited (10 years). Generating a new token immediately invalidates the previous one — update Cursor, Claude, and Codex. If you use a Mattermost Personal Bot, re-save it from My Connections so Bot Server gets the new JWT. The Dashboard warns you 7 days before expiry.
Loom’s /v1 endpoint is ready for beta use as an OpenAI-compatible model router for Cursor, Open WebUI, Mattermost Personal Bot, and scripts. Save a provider API key here once, then use your AI Config JWT as the Bearer token — not the provider key itself. For Claude Code / Desktop, Codex, and other AI clients, connect Loom as MCP only and keep that client’s own subscription for the model brain.
Get a free API key (recommended first)
OpenRouter (best default — many free models): openrouter.ai/settings/keys
Ollama Cloud (hosted open models): ollama.com/settings/keys — model IDs like
Cloudflare Workers AI (token + Account ID): Workers AI
Google Gemini: aistudio.google.com/apikey
Ollama: company server — no key; needs admin
Ollama Cloud (hosted open models): ollama.com/settings/keys — model IDs like
ollama-cloud/gpt-oss:120bCloudflare Workers AI (token + Account ID): Workers AI
Google Gemini: aistudio.google.com/apikey
Ollama: company server — no key; needs admin
OLLAMA_BASE_URL. For local Ollama / LM Studio, point Cursor at localhost directly (not via Loom).
Save the key in AI Models
Open AI Models, expand a provider, paste the key (Cloudflare also needs Account ID), and click Save. Green Ready · N models means Loom can reach the provider — required before
/v1 will work. Without this step, chat requests return 403 provider not configured. Yellow Saved — verify means fix the checklist and click Test ▶. Use Try it out on AI Models to chat through Loom first, then copy a model ID into Cursor or Open WebUI.Point your AI tool at Loom
Order matters: ① Save a provider key in AI Models (green Ready) → ② AI Config → copy AI JWT (not your login session).
Cursor / Open WebUI / OpenAI clients:
Claude Code / Desktop / Codex: MCP only — copy the MCP snippet from AI Config. Use that product’s own subscription for the model. Loom does not support Anthropic Messages or Codex Responses as a product path.
Cursor / Open WebUI / OpenAI clients:
baseURL = https://loom.prod.wellplay.io/v1, API Key = that AI JWT. Model IDs need a provider prefix — copy from AI Models or GET /v1/models, e.g. openrouter/openrouter/free. Do not use bare openrouter/free.Claude Code / Desktop / Codex: MCP only — copy the MCP snippet from AI Config. Use that product’s own subscription for the model. Loom does not support Anthropic Messages or Codex Responses as a product path.
Why use this?
One Loom login unlocks providers that work from the company server (OpenRouter, Cloudflare, Gemini, Ollama Cloud, company Ollama). Routine work can stay off paid APIs. Your keys stay on Loom and are never shared with other users.
Full write-up: Loom — AI Models Guide
🎉
You're all set!
Your AI assistant now has access to NDoc, Memory, Kanban, and Mattermost through Loom. Optional: connect free models via /v1 (Step 7) for Cursor, Open WebUI, or Personal Bot replies.
Go to Dashboard →