Connect other clients · Commerce · MCP

View as Markdown

Get the endpoint URL and a token from the shop administrator: the token is created in the shop admin under Settings (Instellingen) > API tokens (API-tokens), with the channel AI agents (MCP) (AI-agents (MCP)). It is shown only once. See Authentication and tokens.

Generic client configuration

Clients that support MCP servers over HTTP are usually configured with a JSON file. The key names differ per client; what matters is the endpoint URL and the Authorization header. Replace the URL and the token with your own.

mcp.json style

{
  "mcpServers": {
    "commerce": {
      "type": "http",
      "url": "https://<your-shop-domain>/mcp/commerce",
      "headers": {
        "Authorization": "Bearer ocm_<token>"
      }
    }
  }
}

Keep the token out of version control

Do not commit a configuration file that contains a token, and keep the token out of client-side code.

Smoke test

The server is stateless, so you can test a token without any handshake. Send the headers shown below together with the bearer token. A working setup returns HTTP 200 and a JSON-RPC result; 401 means the token is wrong, expired or revoked.

curl

URL='https://<your-shop-domain>/mcp/commerce'
export COMMERCE_MCP_TOKEN='ocm_<token>'

# List the tools this token may use
curl -sS "$URL" \
  -H "Authorization: Bearer $COMMERCE_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# Call a tool
curl -sS "$URL" \
  -H "Authorization: Bearer $COMMERCE_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_sales_summary","arguments":{"from":"2026-10-01","to":"2026-10-06"}}}'

JavaScript

// Run on a server or in a script, never in browser code: the token is a secret.
// Top-level await needs an ES module (a .mjs file or "type": "module").
const url = 'https://<your-shop-domain>/mcp/commerce';
const token = process.env.COMMERCE_MCP_TOKEN; // ocm_<token>

const response = await fetch(url, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
    Accept: 'application/json, text/event-stream',
  },
  body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
});

console.log(response.status, await response.text());

PHP

<?php

$url = 'https://<your-shop-domain>/mcp/commerce';
$token = getenv('COMMERCE_MCP_TOKEN'); // ocm_<token>

$curl = curl_init($url);
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer {$token}",
        'Content-Type: application/json',
        'Accept: application/json, text/event-stream',
    ],
    CURLOPT_POSTFIELDS => json_encode(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']),
]);

$body = curl_exec($curl);

echo curl_getinfo($curl, CURLINFO_RESPONSE_CODE), ' ', $body, PHP_EOL;

Python

import json
import os
import urllib.request

url = "https://<your-shop-domain>/mcp/commerce"
token = os.environ["COMMERCE_MCP_TOKEN"]  # ocm_<token>

request = urllib.request.Request(
    url,
    data=json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list"}).encode(),
    headers={
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
        "Accept": "application/json, text/event-stream",
    },
    method="POST",
)

with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

The curl sample also shows a tools/call request. See the tool reference for the inputs of every tool.

What is not supported

OAuth-only connectors

The server only accepts a static bearer token in the Authorization header. Connectors that can only sign in through OAuth, for example with a login screen or dynamic client registration, are not supported.