The MCP Server uses two credentials that are easy to confuse, so it is worth separating them up front.
| Credential | Used by | Where it goes |
|---|---|---|
| Catalog Token | The MCP Server, to identify the catalog you are granting access to. | The Sales Layer authorization screen during OAuth, or the CATALOG_TOKEN environment variable in a local install. |
| OAuth access token | The MCP client, to call the remote server. | Issued and managed by the client. You never handle it directly. |
X-API-KEY | The Catalog REST API or DAM REST API directly. | An HTTP request header. Not configured by the MCP client. |
Never send the Catalog Token as a bearer token or API key to mcp.saleslayer.com.
The remote server does not accept it that way. It exchanges the Catalog Token for OAuth credentials during the authorization flow. Configuring the token as an API key produces an invalid_token error.
The token is entered in exactly two places:
- The Sales Layer authorization screen, during the OAuth flow, for remote connections.
- The
CATALOG_TOKENenvironment variable, for local installs. See Local development.
Catalog Tokens are issued by Sales Layer Support.
- Confirm you are authorized to request external access for your account. This is normally the account administrator, IT owner, implementation partner, or project owner. If you are not one of them, check with your internal administrator first.
- Contact Sales Layer Support at
support@saleslayer.com, or your account representative. - Provide your company or account name, and the catalog or environment the token should target.
Request a token only for the catalog and use case you need. Start with read-only access for testing, then move to full access once your team has approved the workflow.
Full details are in Getting access to Sales Layer MCP Server.
Remote connections authenticate with OAuth 2.0 using PKCE. Most clients discover the configuration automatically through Dynamic Client Registration.
If your client cannot discover the configuration, enter these values manually:
| Field | Value |
|---|---|
| Authorization URL | https://mcp.saleslayer.com/oauth/authorize |
| Token URL | https://mcp.saleslayer.com/oauth/token |
| Registration URL | https://mcp.saleslayer.com/oauth/register |
| Discovery document | https://mcp.saleslayer.com/.well-known/oauth-authorization-server |
| Grant type | Authorization Code with PKCE |
| Code challenge method | S256 |
| Client secret | Leave empty, unless dynamic registration issues one |
Microsoft Copilot Studio uses the client ID copilot-studio.
Clients that do not support PKCE with S256 cannot connect to the remote server. For those, use a local MCP install if your organization allows it, or call the Catalog REST API or DAM REST API directly with X-API-KEY.
- The client redirects you to the Sales Layer authorization screen.
- You select the access profile. See Access profiles and permissions.
- You paste the Catalog Token and validate it.
- Sales Layer shows the detected catalog and access profile for confirmation.
- The browser redirects back to the client, which stores the OAuth credentials.
Leave the browser window open until the redirect completes. Closing it early leaves the client without valid credentials, which surfaces later as 401 Unauthorized.
- Do not share a Catalog Token in screenshots, emails, support tickets, or chat messages.
- Do not store it in source code, in
mcp.json, or in any file committed to a repository. - Do not paste it into a prompt. The token is entered in the Sales Layer authorization screen, not in a conversation with the assistant.
- Disconnect clients you no longer use.
- If a token is exposed, contact Sales Layer Support immediately so it can be rotated.
When escalating an issue to Support, never send the full token. Support will guide you through validating it securely.