Skip to main content

Call MCP / UCP

Retry the original MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP operation with the AIGW access tokenAIGW access tokenThe token an agent receives after the user authorizes it. It says which user approved which agent for which scopes.:

POST /mcp HTTP/1.1
Host: mcp.example.com
Authorization: Bearer <AIGW_ACCESS_TOKEN>
Content-Type: application/json

The MCP/UCP service uses that AIGW token together with its own server credential to obtain the merchant access tokenMerchant access tokenA token issued by the merchant's own authorization server. Only the MCP/UCP service sees it, never the agent.. The agent does not participate in the merchant token exchange.

What success means for the agent​

From the agent's perspective, the authorization flow is complete when:

  • the MCP/UCP service accepts the AIGW bearer token;
  • the requested tool/operation executes or returns a normal business response;
  • future calls can reuse the token while it remains valid and sufficiently scoped.

Handling insufficient authorization​

If a later MCP/UCP tool requires additional scopes, expect the resource to return an authorization challenge/error that leads you through authorization again for the new permission set. Do not assume one token is valid for every tool exposed by the server.

Keep merchant credentials opaque​

The agent should never need to inspect or store the merchant access token. That separation is intentional: the MCP/UCP operator and AIGW mediate the downstream merchant credential while the agent holds only the AIGW authorization granted by the user.