Getting Access
Introduction
MCP (Model Context Protocol) is an open standard that lets AI clients interact with external services through a unified interface. OneStock exposes its operational capabilities (customer service, post-purchase, order management) as MCP tools. Before diving into authentication and setup, we recommend reading:
OneStock MCP – understand the protocol and how OneStock implements it
Supported tools – explore the full catalog of available operations
Authentication and security
What is authentication
Authentication is the process that verifies your identity before you can interact with the MCP server. Every request to the server must carry a valid proof of identity. Without it, the server immediately rejects the connection.
It is required for three reasons:
Identity: The server needs to know who is making the request. Your identity (derived from your email) is used throughout the entire session to personalize your experience and track your actions.
Access control: Not all users have access to the same tools. Once the server knows who you are, it determines which tools you are allowed to see and use. You will only ever be presented with the tools your organization has granted you.
Session continuity: Your identity is tied to a session that persists across multiple interactions. This means the server remembers your context (your site, your configuration, your previous actions) without asking you to re-authenticate on every request.
OAuth2 protocol
Our MCP relies on OAuth 2.0, the industry-standard protocol for secure authorization and API access management, widely adopted by leading platforms.
By leveraging OAuth2, the MCP ensures a modern, secure, and scalable authentication framework where sensitive user credentials are never exposed. Access is managed through temporary and revocable tokens, providing fine-grained permission control and enhanced security across integrations.
This approach offers:
Secure and standardized third-party integrations,
Centralized and controlled access management,
And alignment with enterprise security best practices.
Using OAuth2 guarantees a reliable and future-proof authentication mechanism designed to meet the expectations of modern enterprise environments.
Sign in process
Access to the OneStock Backoffice or standard OneStock APIs does not automatically grant access to the Onestock MCP. A dedicated MCP access must be requested through your Onestock point of contact before any connection can be established.
To request access, customers must contact their Onestock representative and provide the information below :
User email address
Authentication method requested (see sections Retailer employee and Retailer-owned AI agent )
The list of required tools (see the section Supported tools )
The intended usage and external services that will interact with the MCP
The product team will take care of setting up access. An email will be sent to the customer as soon as this has been done.