{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown","redocly_category":"MCP Server","api_domain":"MCP"},"seo":{"title":"MCP Server authentication","description":"Authenticate the Sales Layer MCP Server with a Catalog Token and OAuth 2.0 with PKCE, and keep AI assistant credentials secure.","siteUrl":"https://docs.api.saleslayer.com/","image":"/assets/sales-layer-horizontal-dark-green.224c048d0bb386d3c2683ba504140512b6233d3c6cbf706ca81e2e3f2f02dbd0.9c1bb791.svg","keywords":["Sales Layer","Sales Layer API","REST API","OpenAPI","PIM API","Product Information Management API","DAM API","Catalog API","product catalog API","product data synchronization","ecommerce integration API","ERP integration","marketplace integration","image management API","digital asset management API","API integration","Model Context Protocol","MCP server","Sales Layer MCP","AI assistant connector","PIM AI assistant"],"lang":"en-US","meta":[{"name":"og:type","content":"website"},{"name":"og:site_name","content":"Sales Layer REST API Documentation"},{"name":"og:title","content":"Sales Layer REST API Documentation"},{"name":"og:description","content":"Technical REST API docs for Sales Layer PIM, Catalog, DAM, ecommerce, ERP, and marketplace integrations."},{"name":"og:image","content":"/assets/sales-layer-horizontal-dark-green.224c048d0bb386d3c2683ba504140512b6233d3c6cbf706ca81e2e3f2f02dbd0.9c1bb791.svg"},{"name":"twitter:card","content":"summary_large_image"},{"name":"twitter:site","content":"@saleslayer"},{"name":"twitter:title","content":"Sales Layer REST API Documentation"},{"name":"twitter:description","content":"Technical REST API docs for Sales Layer PIM, Catalog, DAM, ecommerce, ERP, and marketplace integrations."},{"name":"twitter:image","content":"/assets/sales-layer-horizontal-dark-green.224c048d0bb386d3c2683ba504140512b6233d3c6cbf706ca81e2e3f2f02dbd0.9c1bb791.svg"}],"llmstxt":{"hide":false,"title":"Sales Layer REST API Documentation","description":"Technical guides and OpenAPI references for Sales Layer DAM and Catalog REST APIs.","sections":[{"title":"Guides","description":"Static API guides for authentication, headers, query parameters, responses, rate limiting, and best practices.","includeFiles":["guides/**/*.md","changelog.md"]},{"title":"API Reference","description":"OpenAPI-based references and API overview pages for Sales Layer REST APIs.","includeFiles":["apis/**/*.md","apis/**/*.yaml"]},{"title":"Postman collections","description":"Importable Postman collection and environment instructions for testing Sales Layer REST APIs.","includeFiles":["postman/**/*.md"]},{"title":"MCP server","description":"Documentation for the Sales Layer MCP Server, its tools, access profiles, and how AI assistants consume the Catalog REST API.","includeFiles":["mcp-server/**/*.md"]}]},"jsonLd":{"@context":"https://schema.org","@type":"WebSite","name":"Sales Layer REST API Documentation","url":"https://docs.api.saleslayer.com/","publisher":{"@type":"Organization","name":"Sales Layer","url":"https://www.saleslayer.com/"}}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"mcp-server-authentication","__idx":0},"children":["MCP Server authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The MCP Server uses two credentials that are easy to confuse, so it is worth separating them up front."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Credential"},"children":["Credential"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Used by"},"children":["Used by"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Where it goes"},"children":["Where it goes"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Catalog Token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The MCP Server, to identify the catalog you are granting access to."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Sales Layer authorization screen during OAuth, or the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CATALOG_TOKEN"]}," environment variable in a local install."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth access token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The MCP client, to call the remote server."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Issued and managed by the client. You never handle it directly."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/apis/catalog"},"children":["Catalog REST API"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/apis/dam"},"children":["DAM REST API"]}," directly."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An HTTP request header. Not configured by the MCP client."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-most-important-rule","__idx":1},"children":["The most important rule"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Never send the Catalog Token as a bearer token or API key to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["mcp.saleslayer.com"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The remote server does not accept it that way. It exchanges the Catalog Token for OAuth credentials during the authorization flow. Configuring the token as an API key produces an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invalid_token"]}," error."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token is entered in exactly two places:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The Sales Layer authorization screen, during the OAuth flow, for remote connections."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CATALOG_TOKEN"]}," environment variable, for local installs. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/mcp-server/local-development"},"children":["Local development"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"requesting-a-catalog-token","__idx":2},"children":["Requesting a Catalog Token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Catalog Tokens are issued by Sales Layer Support."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm you are authorized to request external access for your account. This is normally the account administrator, IT owner, implementation partner, or project owner. If you are not one of them, check with your internal administrator first."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Contact Sales Layer Support at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["support@saleslayer.com"]},", or your account representative."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Provide your company or account name, and the catalog or environment the token should target."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Request a token only for the catalog and use case you need. Start with read-only access for testing, then move to full access once your team has approved the workflow."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Full details are in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://support.saleslayer.com/support/solutions/articles/206000072269"},"children":["Getting access to Sales Layer MCP Server"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"oauth-20-with-pkce","__idx":3},"children":["OAuth 2.0 with PKCE"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Remote connections authenticate with OAuth 2.0 using PKCE. Most clients discover the configuration automatically through Dynamic Client Registration."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your client cannot discover the configuration, enter these values manually:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authorization URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://mcp.saleslayer.com/oauth/authorize"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Token URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://mcp.saleslayer.com/oauth/token"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Registration URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://mcp.saleslayer.com/oauth/register"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Discovery document"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://mcp.saleslayer.com/.well-known/oauth-authorization-server"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grant type"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authorization Code with PKCE"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Code challenge method"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["S256"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client secret"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Leave empty, unless dynamic registration issues one"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Microsoft Copilot Studio uses the client ID ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["copilot-studio"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Clients that do not support PKCE with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["S256"]}," cannot connect to the remote server. For those, use a local MCP install if your organization allows it, or call the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/apis/catalog"},"children":["Catalog REST API"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/apis/dam"},"children":["DAM REST API"]}," directly with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-authorization-flow","__idx":4},"children":["The authorization flow"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The client redirects you to the Sales Layer authorization screen."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You select the access profile. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/mcp-server/permissions"},"children":["Access profiles and permissions"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You paste the Catalog Token and validate it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sales Layer shows the detected catalog and access profile for confirmation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The browser redirects back to the client, which stores the OAuth credentials."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Leave the browser window open until the redirect completes. Closing it early leaves the client without valid credentials, which surfaces later as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401 Unauthorized"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"handling-tokens-securely","__idx":5},"children":["Handling tokens securely"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Do not share a Catalog Token in screenshots, emails, support tickets, or chat messages."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Do not store it in source code, in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["mcp.json"]},", or in any file committed to a repository."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Do not paste it into a prompt. The token is entered in the Sales Layer authorization screen, not in a conversation with the assistant."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Disconnect clients you no longer use."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If a token is exposed, contact Sales Layer Support immediately so it can be rotated."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When escalating an issue to Support, never send the full token. Support will guide you through validating it securely."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-pages","__idx":6},"children":["Related pages"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/mcp-server/quickstart"},"children":["Quickstart"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/mcp-server/permissions"},"children":["Access profiles and permissions"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/mcp-server/local-development"},"children":["Local development"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/mcp-server/troubleshooting"},"children":["Troubleshooting"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/authentication"},"children":["REST API authentication"]}]}]}]},"headings":[{"value":"MCP Server authentication","id":"mcp-server-authentication","depth":1},{"value":"The most important rule","id":"the-most-important-rule","depth":2},{"value":"Requesting a Catalog Token","id":"requesting-a-catalog-token","depth":2},{"value":"OAuth 2.0 with PKCE","id":"oauth-20-with-pkce","depth":2},{"value":"The authorization flow","id":"the-authorization-flow","depth":2},{"value":"Handling tokens securely","id":"handling-tokens-securely","depth":2},{"value":"Related pages","id":"related-pages","depth":2}],"frontmatter":{"seo":{"title":"MCP Server authentication","description":"Authenticate the Sales Layer MCP Server with a Catalog Token and OAuth 2.0 with PKCE, and keep AI assistant credentials secure."},"keywords":{"includes":["MCP authentication","OAuth 2.0 PKCE","Catalog Token","MCP credentials","Model Context Protocol"]},"metadata":{"redocly_category":"MCP Server","api_domain":"MCP"}},"lastModified":"2026-08-31T15:07:55.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/mcp-server/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}