Authenticate an MCP client

Connect directly to the live Orderboost MCP resource and use the client's native OAuth flow.

Connect a remote-OAuth-capable Model Context Protocol (MCP) host directly to Orderboost. There is no published orderboost-mcp command, local companion, or stdio fallback.

Use the live resource

Configure this exact Streamable HTTP URL:

https://mcp.checkout.orderboost.org/mcp

The resource runs stateless MCP on the TypeScript SDK 2.0 server. Modern clients can negotiate the 2026-07-28 protocol with server/discover; initialize-based clients continue through the endpoint’s stateless compatibility path. No client setting, session ID, or alternate URL is required.

Orderboost publishes OAuth protected-resource metadata at:

https://mcp.checkout.orderboost.org/.well-known/oauth-protected-resource/mcp

The metadata identifies https://capi.orderboost.org/api/auth as the authorization server. Do not substitute the API URL for the MCP resource URL.

Connect Codex

Add the remote server from the command line:

codex mcp add orderboost --url https://mcp.checkout.orderboost.org/mcp

Restart the client after saving configuration. Use /mcp to inspect the connection. When a protected tool requires sign-in, select Authenticate in the MCP server settings or run:

codex mcp login orderboost

Codex owns the callback, Proof Key for Code Exchange (PKCE) state, and stored OAuth tokens.

Connect Claude Code

Add the remote HTTP server:

claude mcp add --transport http orderboost https://mcp.checkout.orderboost.org/mcp

Run /mcp inside Claude Code to inspect the server and complete OAuth when a protected tool requires it. Claude Code stores and refreshes its own tokens.

Connect Claude or Claude Desktop

Remote custom connectors are available on supported paid Claude plans:

Open Settings, then Connectors
Add a custom connector named Orderboost
Enter https://mcp.checkout.orderboost.org/mcp
Enable the connector for a conversation
Select Connect when a protected tool requires OAuth

Organization owners may need to add the connector before members can enable it.

Let protected tools trigger OAuth

The live remote resource exposes 14 tools:

search_catalog, lookup_catalog, get_product and create_buy_link are anonymous
Cart, checkout, completion, cancellation and handoff tools require Orderboost OAuth

Use create_buy_link with the exact canonical variant URL when a buyer wants a checkout URL. It does not create shared cart state and does not require sign-in. Each buyer receives a fresh hosted checkout after opening the returned checkout_url.

Do not authenticate before catalog discovery. Attempt the requested protected operation, then use the MCP host’s native authorization action after Orderboost returns 401 Unauthorized and mcp/www_authenticate metadata.

The MCP host owns authorization. Do not ask a person to paste an authorization code, access token, password, or client secret into chat.

Verify the connection mode

The host is connected correctly when it can list the 14 remote tools and call search_catalog or create_buy_link without signing in. A protected call should offer the host’s OAuth action.

If the host cannot complete remote MCP OAuth, anonymous catalog and buyer-link tools may still work but protected Orderboost tools are not supported in that host today.

Protect credentials and approval

The MCP client must keep OAuth state, authorization codes, access tokens, and refresh tokens outside model messages. Never ask a person to paste a password, OAuth token, client secret, email verification code, payment credential, or checkout handoff code into chat.

OAuth grants access to protected checkout state. It does not authorize payment. Agent-controlled completion still requires the buyer’s exact purchase grant for the current checkout revision.