Other MCP clients
Any AI client that supports the Model Context Protocol can connect to MCP Server.
If your store is behind Cloudflare or another CDN/WAF, you must whitelist the MCP endpoints before connecting. See Protected stores for step-by-step instructions.
Server details
Use the following details to configure your AI client. You can find these values on the MCP Info tab in Magento admin (System -> Permissions -> All Users -> [Your User] -> MCP Info).
- MCP Server URL:
https://your-store.com/mcp - OAuth Discovery URL:
https://your-store.com/.well-known/oauth-authorization-server - Authentication: OAuth 2.1
General setup guide
- Check your AI client's documentation for remote MCP server or custom connector support.
- Use the MCP Server URL above when prompted for a server URL or endpoint.
- Set the authentication method to OAuth if your client supports it.
- Complete the authentication steps in the browser window that opens.
CLI clients
Most CLI-based clients support adding a remote MCP server via a command like:
[client] mcp add --transport http <server-key> <mcp-server-url>
Replace the client name and adjust flags according to your client's documentation.
Some clients support a --scope flag to control where the server is registered (e.g. --scope user for global or --scope project for the current project only). Check your client's documentation for available options.
Clients without OAuth support
Some AI clients (e.g. Manus.ai) do not support OAuth 2.1 for custom MCP servers. For these clients, you can use a personal access token (PAT) as a static Bearer token.
We recommend using OAuth 2.1 when possible for stronger security. Use personal access tokens only when your client does not support OAuth.
Prerequisites
An administrator must enable personal access tokens in Stores -> Configuration -> MCP Server -> Authentication -> Personal Access Tokens. See Settings for details.
Generating a token
- Navigate to the MCP Info tab (Account Settings or System -> Permissions -> All Users -> [Your User] -> MCP Info).
- Open the Other client tab.
- In the Clients without OAuth support section, click Generate Token.
- Enter your admin password to confirm.
- The
Authorization: Bearer <token>header is displayed. Copy it and configure it in your AI client.
Viewing an existing token
For security, the token is hidden by default on page load. Click Show Token and enter your password to reveal it.
Revoking a token
Click Revoke Token in the Other tab, or use the Revoke action in the MCP Users grid (System -> AI Agent Connector -> MCP Users -> Details).
Generating a new token automatically revokes the previous one.