MCP server

How access is granted#

The MCP is not self-service. The merchant sends the request with the form below. Tilopay creates a dedicated user, exclusive to this service and tied to one merchant, and registers that merchant API credentials on the server side, encrypted. The user receives an invitation email and sets their own password.

Three things worth knowing before requesting access:

1. The MCP user is different from the merchant API user. If you already have API credentials, you do not reuse them here.
2. Because the user is tied to one merchant, the agent only reaches the data and the operations of that merchant.
3. The merchant never pastes its apiKey, apiUser or apiPassword into the MCP client.

MCP usage may carry additional costs depending on the volume used. The support team shares that detail after validating the merchant transaction volume.

Access request#

Connection#

The server is https://mcp.tilopay.com/mcp. For an approved user:

1. Add the server in the MCP client with that URL.
2. The client discovers authentication from the 401 with WWW-Authenticate, which points to /.well-known/oauth-protected-resource.
3. The client registers dynamically and opens the authorization screen.
4. The user signs in with their account and sees a consent screen with the application requesting access, the return URL and the permissions.
5. On approval, the client is connected.

The model is OAuth 2.0 with authorization_code and refresh_token. The client discovers the identity provider endpoints on its own: the only thing to configure is the server URL.

From the most used MCP clients#

• Claude (desktop and web): add a remote connector with the server URL and complete sign-in in the window it opens.
• ChatGPT: add the server as a remote connector with that same URL; authorization completes in the browser.
• Cursor, VS Code and other editors: declare a remote HTTP MCP server with the URL, with no token in the configuration file; the editor opens the browser to authorize.
• Your own client: use an MCP client with Streamable HTTP transport and OAuth 2.0 support with dynamic registration. The sequence is the one above: 401, discovery, registration, authorization, connection.

The transport is Streamable HTTP. The available tools are listed by group: sales and transactions, payment links, catalog, contacts and support and diagnostics. Before connecting an agent, read what it can do.