---
title: "Provision MCP client-credentials"
method: POST
path: "/mcp/credentials"
tags: ["MCP"]
---

# Provision MCP client-credentials

`POST /mcp/credentials`

## Request

- Base URL: `https://app.gc.ai/api/external/v1`
- URL: `https://app.gc.ai/api/external/v1/mcp/credentials`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/gc-ai/apis/gc-ai-external-api/docs/mcp/credentials/post.ts> (a function with typed inputs; its response is checked against the schema)

Mint an OAuth 2.0 client-credentials credential so a machine client (e.g. Salesforce AgentForce) can obtain org-scoped MCP access tokens.

Requires an **org-scoped** API key (`gcai_...`); user-scoped keys receive 403. The organization's single M2M application is created on first call and reused thereafter, so this endpoint is safe to call repeatedly. Each call mints a **new** secret and returns it **once** (it cannot be retrieved again). A WorkOS application allows up to 5 live credentials; once that limit is reached the identity provider rejects further mints (returned here as 502) until an existing credential is revoked.

Hand the returned `client_id`, `client_secret`, `token_endpoint`, and `resource` to the machine client's OAuth configuration.

## Response `200`

A newly minted credential (secret shown once)

- McpCredentialResponse
  - `client_id` string, required: The M2M application's client ID. Stable across rotations; configure it as the OAuth client ID in Salesforce.
  - `client_secret` string, required: The client secret for the client-credentials grant. Shown only once, here, at creation. Store it securely; it cannot be retrieved again.
  - `token_endpoint` string, uri, required: The OAuth 2.0 token endpoint to exchange the credential for an access token (`grant_type=client_credentials`).
  - `resource` string, uri, required: The MCP resource URL to send as the `resource` parameter on the token request (OAuth 2.1). Also the MCP endpoint the issued token is used against.
  - `grant_type` 'client_credentials', required: The OAuth 2.0 grant type to use with this credential.

## Other responses

- `401`: Missing or malformed API key
- `403`: Key is not org-scoped, or the API key is invalid
- `404`: MCP is not configured for this deployment
- `429`: Rate limit exceeded. See [Rate Limits](https://docs.gc.ai/api-reference/concepts/rate-limits) for the tiers, limits, and how to back off.
- `500`: Internal server error
- `502`: The identity provider failed to provision the credential (includes the 5-credential limit being reached)
- `503`: Service temporarily unavailable

---

[API](https://skmtc.dev/gc-ai/apis/gc-ai-external-api.md) - [All operations](https://skmtc.dev/gc-ai/apis/gc-ai-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gc-ai/apis/gc-ai-external-api/revisions/2bbdfddf7107?raw)