# Connect other clients

A generic MCP client configuration, a curl smoke test, and what is not supported.

Section: Commerce · MCP
Canonical URL: https://docs.omniretailconnect.nl/commerce/mcp/connect-other-clients

Get the endpoint URL and a token from the shop administrator: the token is created in the shop admin under **Settings** (*Instellingen*) > **API tokens** (*API-tokens*), with the channel **AI agents (MCP)** (*AI-agents (MCP)*). It is shown only once. See [Authentication and tokens](https://docs.omniretailconnect.nl/commerce/getting-started/authentication.md#creating-tokens).

## Generic client configuration

Clients that support MCP servers over HTTP are usually configured with a JSON file. The key names differ per client; what matters is the endpoint URL and the `Authorization` header. Replace the URL and the token with your own.

**mcp.json style**

```json
{
  "mcpServers": {
    "commerce": {
      "type": "http",
      "url": "https://<your-shop-domain>/mcp/commerce",
      "headers": {
        "Authorization": "Bearer ocm_<token>"
      }
    }
  }
}
```

> **Security — Keep the token out of version control:** Do not commit a configuration file that contains a token, and keep the token out of client-side code.

## Smoke test

The server is stateless, so you can test a token without any handshake. Send the headers shown below together with the bearer token. A working setup returns HTTP `200` and a JSON-RPC `result`; `401` means the token is wrong, expired or revoked.

**Smoke test · curl**

```bash
URL='https://<your-shop-domain>/mcp/commerce'
export COMMERCE_MCP_TOKEN='ocm_<token>'

# List the tools this token may use
curl -sS "$URL" \
  -H "Authorization: Bearer $COMMERCE_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# Call a tool
curl -sS "$URL" \
  -H "Authorization: Bearer $COMMERCE_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_sales_summary","arguments":{"from":"2026-10-01","to":"2026-10-06"}}}'
```

**Smoke test · JavaScript**

```javascript
// Run on a server or in a script, never in browser code: the token is a secret.
// Top-level await needs an ES module (a .mjs file or "type": "module").
const url = 'https://<your-shop-domain>/mcp/commerce';
const token = process.env.COMMERCE_MCP_TOKEN; // ocm_<token>

const response = await fetch(url, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
    Accept: 'application/json, text/event-stream',
  },
  body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
});

console.log(response.status, await response.text());
```

**Smoke test · PHP**

```php
<?php

$url = 'https://<your-shop-domain>/mcp/commerce';
$token = getenv('COMMERCE_MCP_TOKEN'); // ocm_<token>

$curl = curl_init($url);
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer {$token}",
        'Content-Type: application/json',
        'Accept: application/json, text/event-stream',
    ],
    CURLOPT_POSTFIELDS => json_encode(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']),
]);

$body = curl_exec($curl);

echo curl_getinfo($curl, CURLINFO_RESPONSE_CODE), ' ', $body, PHP_EOL;
```

**Smoke test · Python**

```python
import json
import os
import urllib.request

url = "https://<your-shop-domain>/mcp/commerce"
token = os.environ["COMMERCE_MCP_TOKEN"]  # ocm_<token>

request = urllib.request.Request(
    url,
    data=json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list"}).encode(),
    headers={
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
        "Accept": "application/json, text/event-stream",
    },
    method="POST",
)

with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())
```

The curl sample also shows a `tools/call` request. See the [tool reference](https://docs.omniretailconnect.nl/commerce/mcp/tools.md) for the inputs of every tool.

## What is not supported

> **Warning — OAuth-only connectors:** The server only accepts a static bearer token in the `Authorization` header. Connectors that can only sign in through OAuth, for example with a login screen or dynamic client registration, are not supported.