Skip to main content
The MCP server is an OAuth 2.1 protected resource. Compliant MCP clients — including Claude and ChatGPT — discover and complete the flow automatically; you only click Approve.

​
Discovery

The server advertises its authorization server per RFC 9728. An unauthenticated request returns 401 with a WWW-Authenticate header pointing at:
That document names the authorization server, whose metadata (RFC 8414) lives at:

​
Flow

  1. Dynamic client registration (RFC 7591) — the assistant registers itself and gets a client_id. No manual setup.
  2. Authorization code + PKCE (S256) — you sign in to Take App, choose which store to connect, and approve. The connection is scoped to that one store.
  3. Token exchange — the assistant exchanges the code for an access token and a refresh token.
Access tokens are Bearer tokens sent on every request:

​
Permissions

Connections use the all scope for full access to read and manage products, orders, customers, and inventory, and to send messages. It includes token refresh for up to one year from approval; after that, reconnect the assistant. Granular tool permissions will come later.

​
Managing connections

Every connected assistant appears in your admin dashboard under Settings → Integrations → API keys, where you can disconnect it at any time. Disconnecting revokes its token immediately.