Skip to main content
Connect to https://api.interchange.io/mcp/v3 with OAuth or an organisation API key. The credential determines the home account, reachable accounts, and permissions; the URL does not select Buyer or Seller behavior.
  • Use OAuth for interactive clients and human-authorized work.
  • Use an organisation API key for headless automation, stored in a secret manager and sent as Authorization: Bearer YOUR_API_KEY.
  • Grant only the permissions the integration needs. A visible tool may still refuse a write when the credential lacks the required permission.
Call get_status after authentication. A successful connection proves that the credential is valid, not that the active account is enrolled in the v3 preview.

​
OAuth resource binding

OAuth discovery for v3 advertises https://api.interchange.io/mcp/v3 as the exact protected resource. MCP clients carry that URI through authorization, token exchange, and refresh. Interchange issues dedicated MCP access and refresh credentials for that resource; a v3 credential is rejected on another MCP endpoint or on the REST API. The protected-resource metadata document is available at https://api.interchange.io/.well-known/oauth-protected-resource/mcp/v3. Clients should follow the resource_metadata URL in the server’s WWW-Authenticate challenge instead of constructing it themselves.

Full authentication reference

Review OAuth, organisation API keys, service tokens, permissions, and stable v2 versioning behavior in the canonical authentication guide.