How to Manage Business Expenses with Claude Code

Key Highlights

Claude Code manages business expenses once you connect the Reap Business Account MCP with one API key and one command.
You set what Claude Code can do through the key's scopes, so a read-only key gives a read-only agent.
The Reap Business Account MCP reads card activity, manages cards and records the bank transfers you send, and it has no tool that shows full card details.
You need Business Account API access, which a team admin requests in the dashboard under API.

A finance or operations lead can manage business expense with Claude Code by connecting it to a Reap Business Account and asking in plain English. The connection uses the Business Account MCP, a remote server that Reap hosts, and your own API key. As an expense management MCP, it lets Claude Code list spend and freeze cards within your key's scopes. To get a gist of what our MCP does, check out our Business Account MCP introductory post.

You can connect in minutes when your Business Account already has API access.

What do you need to manage business expenses with Claude Code?

To manage business expenses with Claude Code, you need three things:

A Business Account with API access.
An admin who can create an API key.
Claude Code, on a computer whose public IP address the key's allowlist can check.

If your Business Account does not have API access yet, an admin can request it in the dashboard under API, then Request access. Access is granted per business, and the business's card application must be issued.

How do you connect Claude Code to your Business Account?

You connect Claude Code to your Business Account in four steps: create a key, save it, add the server and check the connection. The setup guide documents each step.

Create an API key. An admin goes to API, then Create key, in the dashboard and picks the scopes. Begin with the read scopes in the table below. Add your computer's public IP to the allowlist, which curl ifconfig.me prints. You see the key once, so copy it.

Save the key as an environment variable. Run this in zsh and paste the key when prompted. Then start Claude Code from the same terminal.

read -rs "REAP_API_KEY?Paste your API key: "; echo export REAP_API_KEY

Add the server. Run this command once.

claude mcp add --transport http reap https://api.global.direct.reap.global/mcp \ --header 'Authorization: Bearer ${REAP_API_KEY}'

Check the connection. Run claude mcp list, or type /mcp inside Claude Code, and look for the server's status. Then ask "Who are my team members?". Claude Code saves the entry without testing the credentials, so a typo in the key shows up here as a failed connection.

Can Claude Code track your business expenses?

Yes, Claude Code can track your business expenses through the Business Account MCP, within the key's scopes. The five prompts below cover common finance and operations jobs.

Prompt	What Claude Code does	Scopes needed
"Show me this month's card spend by team member"	Reads team members and card activity, then summarises them	`team_members:read`, `card_activities:read`
"Put September's card activity in a CSV for our ERP"	Reads card activity, then builds the file on your computer	`card_activities:read`
"Create 5 virtual cards for the marketing team with a $500 monthly limit"	Asks for missing details, previews the creates, applies them after you approve	`cards:write`, `spend_controls:write`
"Freeze the card ending 4821"	Freezes one card, and asks first if you set an ask rule, covered below	`cards:write`
"Freeze all of Alex's cards. Alex left today."	Finds Alex's cards, then freezes them	`cards:read`, `cards:write`

If your business uses card approvals, an approver must accept each new card in the dashboard before it exists. Claude Code runs the analysis, so check a report's totals against the expense management dashboard before you send it.

Is it safe to let AI agents handle your business expenses?

Letting AI agents handle your business expenses is as safe as the limits you set on them. Claude Code works within the permissions of your API key, so you control the risk with the key's scopes, approval rules on every change and a person on every step that cannot be undone.

What can be delegated to AI agents in business expense management?

You can delegate expense reports, card limits, freezes and new cards to an AI agent today, with approval rules on every change. The table shows what to hand to Claude Code and the guardrail for each task.

Task	Delegate it?	Guardrail
Spend summaries by team member and card activity exports	Yes	Use a read-only key, and check the totals against the dashboard before you send a report
Limit changes, freezes and usage hours on existing cards	Yes, with approval	Keep the approval rules from the next section on for those tools
New cards for joiners or a team	Yes, through a preview	Every card goes through a preview, and an approver accepts it if your business uses Approvals
Terminating cards	Only with a person's approval	Termination is permanent. It always goes through a preview that a person approves
Moving money	Yes, with approval	Require a person's approval before any tool that sends funds runs, so each transfer is approved before it goes out
Recording bank transfers	Yes, with approval	Add the ask rules from the next section, so every recorded transfer waits for your approval

Start with the first row and add write scopes one task at a time.

What controls protect your business expense data when an AI agent uses it?

Three controls protect your business expense data when an AI agent uses it: the key's permissions, its IP allowlist and your right to revoke it. A read-only key limits the agent to reading. The key's IP allowlist is on by default and limits where requests can come from. You can revoke the key in the dashboard, and access stops on the next call.

Reap adds protections of its own, and you manage them in the Reap dashboard. An admin can edit a key's scopes after creating it, and revocation takes effect immediately. In the approval setting Reap recommends, every card change and every recorded bank transfer waits for your yes.

For safety and privacy, Reap's Business Account MCP also has no tool that shows full card details, so the agent never reveals a card number. Creating or terminating a card always goes through a preview. If your business uses Approvals in the dashboard, an approver must accept each card the agent creates. The approval rules in the next section apply on top of these. (See the API docs for how to limit a key's access and the setup guide for how to require human approval on changes.)

Requests and replies still pass through the AI provider you choose, so share only the data a task needs.

How do you stop Claude Code from changing cards without your approval?

You stop Claude Code from changing cards without your approval by limiting the key's scopes and by adding an ask rule for every tool that changes data.

Access level	Scopes the key needs
Read-only	`treasury_funding:read`, `treasury_transactions:read`, `team_members:read`, `cards:read`, `card_account_balances:read`, `card_activities:read`
Manage cards	All read scopes, plus `cards:write` and `spend_controls:write`
Record bank transfers	Add `treasury_funding:write`

Never add cards:read_vault to the key, because none of the Business Account MCP tool uses it. Add the ask rules to ~/.claude/settings.json so you approve each write.

{ "permissions": { "ask": ["mcp__reap__rename_card", "mcp__reap__freeze_card", "mcp__reap__unfreeze_card", "mcp__reap__update_card_usage_hours", "mcp__reap__update_card_spend_control", "mcp__reap__apply_card_changes", "mcp__reap__confirm_treasury_bank_transfer"] } }

You create or terminate a card through a preview first. Claude Code calls preview_card_changes, a tool that checks up to 25 changes, at most one per card, and changes nothing. Claude Code then calls apply_card_changes with the preview's reference, which stays valid for one hour. The MCP does not force a preview when a change touches several cards. Some models freeze cards one at a time, so keep the approval rules on for every write.

What can't Claude Code do with your Business Account?

Claude Code cannot show full card details or create anything other than virtual cards. The Reap Business Account MCP has no tool that shows full card details, and new cards are always virtual. Today the MCP shares funding instructions and records a bank transfer you already sent, as the Business Account MCP page describes.

Large create batches take several calls. You can send up to 25 changes in one bulk request, and your business shares an hourly card creation limit with the dashboard.
Usage hours are in UTC. You set a card's hours in UTC.
Chat-based AI apps that sign in through OAuth are not supported yet.

What do common Claude Code connection errors mean?

A 401 or 403 points you to the key or its IP allowlist. Reap's errors name any missing scope and end with a Reference ID that you send to Reap Support.

What you see	What it means	What you do
`401`	The key is missing, mistyped or revoked	Check `REAP_API_KEY` in the terminal where you started Claude Code, then restart Claude Code
`403`	Your IP is not on the key's allowlist, often after a network change	Add the new IP in the dashboard
A missing scope error	The key lacks a permission, and the error names it	Ask an admin to add that scope to the key
`429`	You sent too many requests	Wait a minute and try again

How Reap Can Help

Reap's Business Account brings expense management, spend controls and corporate cards into one account. The Business Account API and MCP expose the same controls.

New to Reap? Create an account. Once your card application is issued, an admin can request Business Account API access in the dashboard.

‍

Disclaimer

The information provided in this material is for general informational purposes only and does not constitute legal, financial, tax, or business advice. It should not be interpreted as a recommendation, offer, solicitation, or inducement to engage with Reap’s products or services. Any use of Reap’s services is at the user’s sole risk and discretion.

Reap makes no representation or warranty, express or implied, regarding the accuracy, completeness, or reliability of the information provided. Services are governed exclusively by Reap’s applicable legal agreements. Service availability, features, and eligibility may vary by jurisdiction and are subject to regulatory, card network, and operational limitations.

All trademarks, logos, and brand names are the property of Reap and/or their respective owners. References to third-party platforms or services are for descriptive purposes only and do not imply endorsement, partnership, or affiliation.

Reap’s services and information are provided on an "as is" and "as available" basis, without warranties of any kind. Reap shall not be liable for any loss or damage arising from the use of, or reliance on, this information or its services.