docs: claude.ai custom connector instructions (query-param key, header-beta alternative, cloud-origin note)

docs/USER-GUIDE.md

@@ -102,16 +102,44 @@ whichever AI you already use, and it operates the platform with exactly the
 permissions of the key you give it.
 
 **Endpoint:** `POST https://<platform>/mcp` (Streamable HTTP)
-**Auth:** `Authorization: Bearer <your-api-key>` header
+**Auth:** either an `Authorization: Bearer <your-api-key>` header, **or** the
+key as a URL parameter: `https://<platform>/mcp?api_key=<your-api-key>` — for
+hosts whose connector setup can't send custom headers.
+
+### Claude (claude.ai web / desktop / mobile)
+
+1. Go to **Settings → Connectors** (on Team/Enterprise plans an Owner adds it
+   first under Organization settings → Connectors; members then connect
+   individually)
+2. Click **+ Add custom connector**
+3. Name it (e.g. "Demos") and paste the URL **with your key included**:
+   `https://<platform>/mcp?api_key=dp_yourkeyhere`
+4. Click **Add**. If your account shows a **Request headers** section in the
+   dialog (beta feature), you can instead use the plain URL
+   `https://<platform>/mcp` and add a header `Authorization` =
+   `Bearer dp_yourkeyhere` — functionally identical; prefer it when available
+   since the key stays out of the URL.
+5. In a conversation, open the **+ / connectors** menu and enable the
+   connector, then just talk: "list my demos".
+
+Notes: Claude connects to the server **from Anthropic's cloud**, not your
+device — the platform must be reachable on the public internet (a normal
+HTTPS deployment is fine; a laptop-only or VPN-only instance is not). The key
+in the URL is visible to anyone who can see your connector settings — treat
+the connector entry like a stored credential, and use a key with only the
+scopes you want this assistant to have.
+
+### Claude Code (CLI)
 
-**Claude Code:**
 ```
 claude mcp add --transport http demos https://<platform>/mcp \
   --header "Authorization: Bearer dp_yourkey"
 ```
 
-**Other MCP hosts:** any host supporting Streamable HTTP remote servers with a
-custom auth header works the same way.
+### Other MCP hosts
+
+Any host supporting remote Streamable HTTP servers works — use the header
+form if the host supports custom headers, the `?api_key=` URL form if not.
 
 **What your agent sees** depends on the key's scopes. With `read,author` it can
 inspect demos and analytics, write and revise every tooltip, place hotspots,