MCP / UCP Integration

Protect your MCP/UCP service with OAuth: unauthenticated agents discover AIGW, users authorize the agent, and your server turns the resulting AIGW access token into the merchant access token required by the downstream API.

End state

When the integration is complete:

1. An unauthenticated agent calls your MCP/UCP endpoint.
2. Your endpoint returns 401 and points the agent to OAuth Protected Resource Metadata.
3. The agent discovers AIGW and completes OAuth Authorization Code + PKCE with the user.
4. The agent retries your endpoint with an AIGW access token.
5. Your server authenticates itself to AIGW using its project-level server credential (Proxy client in the Console).
6. Your server asks AIGW for the token corresponding to the merchant resource.
7. Your server calls the merchant backend with that merchant access token.

Read in this order

1. Quickstart
2. Configure AIGW
3. Protect your MCP / UCP endpoint
4. Accept an AIGW-authorized request
5. Get a merchant access token
6. Call the merchant backend

If a merchant's IAM administrator is a different team or company, stop at the handoff in Configure AIGW and send them to Configure your authorization server.