Skip to main content

MCP / UCP Integration

This section is for the developer who owns or operates the MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP-facing service. Your goal is to make the service behave like a protected OAuth resource: unauthenticated agents discover AIGW, users authorize the agent, and your server turns the resulting AIGW access tokenAIGW access tokenThe token an agent receives after the user authorizes it. It says which user approved which agent for which scopes. into the merchant token required by the downstream API.

You do not need to understand every AIGW object before starting. The quickstart takes you through the minimum setup in order.

End state​

When the integration is complete:

  1. An unauthenticated agent calls your MCP/UCP endpoint.
  2. Your endpoint returns 401 and points the agent to OAuth Protected ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. Metadata.
  3. The agent discovers AIGW and completes OAuth Authorization Code + PKCEPKCEProof Key for Code Exchange: binds an authorization request to the later code exchange so a stolen code is useless. with the user.
  4. The agent retries your endpoint with an AIGW access token.
  5. Your server authenticates itself to AIGW using its project-level server credential (currently named Proxy clientProxy clientThe server-side credential (client ID and secret) the MCP/UCP service uses to authenticate itself to AIGW. Never give it to an agent. in the console).
  6. Your server asks AIGW for the token corresponding to the merchant resource.
  7. Your server calls the merchant backend with that merchant token.

Read in this order​

  1. Quickstart
  2. Configure AIGW
  3. Protect your MCP / UCP endpoint
  4. Accept an AIGW-authorized request
  5. Get a merchant access token
  6. Call the merchant backend

If a merchant's IAM administrator is a different team or company, stop at the handoff in Configure AIGW and send them to Configure your authorization server.