GCgc-ai
MCP

Provision MCP client-credentials

Mint an OAuth 2.0 client-credentials credential so a machine client (e.g. Salesforce AgentForce) can obtain org-scoped MCP access tokens.

Requires an org-scoped API key (gcai_...); user-scoped keys receive 403. The organization's single M2M application is created on first call and reused thereafter, so this endpoint is safe to call repeatedly. Each call mints a new secret and returns it once (it cannot be retrieved again). A WorkOS application allows up to 5 live credentials; once that limit is reached the identity provider rejects further mints (returned here as 502) until an existing credential is revoked.

Hand the returned client_id, client_secret, token_endpoint, and resource to the machine client's OAuth configuration.

post/mcp/credentials

Request

Response

A newly minted credential (secret shown once)

client_idstring required

The M2M application's client ID. Stable across rotations; configure it as the OAuth client ID in Salesforce.

client_secretstring required

The client secret for the client-credentials grant. Shown only once, here, at creation. Store it securely; it cannot be retrieved again.

token_endpointstring uri required

The OAuth 2.0 token endpoint to exchange the credential for an access token (grant_type=client_credentials).

resourcestring uri required

The MCP resource URL to send as the resource parameter on the token request (OAuth 2.1). Also the MCP endpoint the issued token is used against.

grant_type'client_credentials' required

The OAuth 2.0 grant type to use with this credential.

Example response

{
  "client_id": "client_01HXWKHA5SX0JZYAD037JBE3PT",
  "token_endpoint": "https://your-org.authkit.app/oauth2/token",
  "resource": "https://app.example.com/api/mcp"
}

Changes

No recorded changes to this operation across all 1 revision of this API.