MCP setup guide

Connect any Model Context Protocol client to your Pocketsflow account. The hosted server at https://api.pocketsflow.com/mcp exposes the full public API as tools — create products, read orders, issue refunds, manage webhooks, send newsletters, and more — scoped to your account. It works with any AI app or model provider that speaks MCP, not one vendor.

Endpoint

https://api.pocketsflow.com/mcp — Streamable HTTP. Add the URL, then sign in to Pocketsflow and click Allow access. No API key needed.

This page is the copy-paste setup guide. For the full tool list and how the server works, see MCP server. For editor-specific workflows (project rules, scaffolding), see Claude Code, Cursor, and Windsurf.

1. How signing in works

Most MCP clients support MCP authorization (OAuth): Claude, ChatGPT, Cursor, VS Code, Gemini CLI, Windsurf, and agents built on the official MCP SDKs. With them you only add the server URL:

Add https://api.pocketsflow.com/mcp to your app (step 2 below). Leave any token or header fields empty.
When you connect, your browser opens Pocketsflow. Sign in if asked and check which app is asking.
Click Allow access. You’re sent back to the app and the tools appear.

Pocketsflow creates a dedicated API key named MCP: <app name> for that connection, in the mode your account is in (live or test), and the app only ever receives short-lived tokens that refresh on their own. Delete that key under Developers → API keys to disconnect it. Nothing is tied to one AI vendor. Pocketsflow accepts every standard way an MCP client identifies itself: dynamic client registration, Client ID Metadata Documents, web redirects, loopback redirects on any port (CLIs), and app schemes such as cursor:// or vscode:// (desktop apps).

Alternative: API key (headless / CI)

For scripts, CI jobs, the @pocketsflow/mcp stdio bridge, or a client that can only send a static header, create a key yourself and skip the sign-in. These are the same API keys the REST API uses.

Open the dashboard → Developers → API keys.
Create a key. Prefer pk_test_… while you set things up.
Copy the key once — it is shown only at creation.

Prefix	Mode	Use
`pk_test_…`	Test	Sandbox data. No real money. Start here.
`pk_live_…`	Live	Real products, customers, and payments.

Send it on every request:

Authorization: Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx

Treat API keys like passwords. An agent with a pk_live_… key can create and delete real data. Use a dedicated, revocable key per client, keep configs out of git, and rotate if a key leaks.

2. Add the server to your client

Pick your client. The server URL is all you need: connect, sign in, and click Allow access. The API-key variants are only for headless setups or clients without OAuth.

Claude
Claude Desktop
Cursor
ChatGPT

Claude’s hosted custom connectors use OAuth. You only paste the server URL, then approve the connection with your Pocketsflow login. No API key to create or copy.

Open Customize → Connectors.
Click + → Add custom connector.
Name it Pocketsflow and enter https://api.pocketsflow.com/mcp as the remote MCP server URL.
Leave Advanced settings empty and click Add.
Click Connect. Pocketsflow opens in your browser: sign in if asked, check that Claude is the app asking, and click Allow access.

Pocketsflow creates a dedicated API key named MCP: Claude for the connection. Delete it under Developers → API keys to disconnect. Claude discovers the OAuth endpoints automatically, so there is no URL key or custom-header field to fill in.After connecting, enable Pocketsflow from the + → Connectors menu in a new chat and ask Claude to list your products.

The simplest route is a custom connector: follow the Claude tab. A connector you add to your Claude account is available in Claude Desktop too, and you approve it the same way (sign in, click Allow access).Using the local config file instead? Claude Desktop’s claude_desktop_config.json only launches stdio servers. Bridge the hosted HTTP endpoint with mcp-remote (requires Node.js 18+), which runs the same Pocketsflow sign-in in your browser the first time it connects.

Open Settings → Developer → Edit Config (creates claude_desktop_config.json if needed).
Merge the block below into mcpServers.
Quit Claude Desktop completely and relaunch. When your browser opens Pocketsflow, sign in and click Allow access.

Config paths

OS	Path
macOS	`~/Library/Application Support/Claude/claude_desktop_config.json`
Windows	`%APPDATA%\Claude\claude_desktop_config.json`
Linux	`~/.config/Claude/claude_desktop_config.json`

{
  "mcpServers": {
    "pocketsflow": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.pocketsflow.com/mcp"]
    }
  }
}

After restart, open a new chat and confirm pocketsflow tools appear under the hammer / tools menu.Headless / API key variant. To skip the sign-in, pass a key as a header:

{
  "mcpServers": {
    "pocketsflow": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.pocketsflow.com/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Put the Bearer value in env, not inline in args. Claude Desktop does not escape spaces in args reliably (especially on Windows) — the Authorization:${AUTH_HEADER} form avoids that.

Prefer the terminal? Claude Code supports remote HTTP natively:

claude mcp add --transport http pocketsflow https://api.pocketsflow.com/mcp

Then run /mcp inside Claude Code, pick pocketsflow, and choose Authenticate.

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project). With just the URL, Cursor runs the sign-in for you: when it connects, sign in to Pocketsflow and click Allow access.

{
  "mcpServers": {
    "pocketsflow": {
      "url": "https://api.pocketsflow.com/mcp"
    }
  }
}

Headless / API key variant. To skip the sign-in, add a key as a header:

{
  "mcpServers": {
    "pocketsflow": {
      "url": "https://api.pocketsflow.com/mcp",
      "headers": {
        "Authorization": "Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Reload Cursor (or toggle the server in Settings → MCP). In Agent mode, Composer lists the Pocketsflow tools automatically.

If you use the header variant, keep mcp.json out of version control — it contains your API key.

Deeper Cursor workflow (project rules, OpenAPI docs index): Cursor + Pocketsflow.

ChatGPT connects to remote HTTPS MCP servers only (no local stdio). Custom connectors need Developer Mode on a paid plan (Plus, Pro, Team, Enterprise, or Edu).

Enable Developer Mode

In ChatGPT, open Settings → Apps & Connectors → Advanced settings (wording may be under Security and login on some builds) and turn Developer Mode on.

Create a connector

Go to Settings → Apps & Connectors (or chatgpt.com/connectors) → Create / Add custom connector. Fill in:

Field	Value
Name	`Pocketsflow`
Description	Operate my Pocketsflow store via MCP
Connector URL	`https://api.pocketsflow.com/mcp`
Authentication	OAuth

Save, then sign in to Pocketsflow in the window that opens and click Allow access. No API key needed. (No OAuth option on your plan? Choose Token and paste a pk_test_… key instead.)

Use it in a chat

Start a new conversation → + → enable the Pocketsflow app / Developer Mode tools → ask something read-only first (see below).

With Token auth, if the UI asks for a custom header instead of a Token field, set Authorization to Bearer pk_test_… (including the Bearer prefix). Workspace admins on Business/Enterprise may need to allow custom connectors first.

3. First tool call walkthrough

Once the client shows Pocketsflow tools, verify the connection with a read-only call before anything that writes.

Confirm the account

Ask:

Using the Pocketsflow tools, call get_account and summarize who I’m authenticated as.

You should see your store / account details. A 401 or authentication error means the connection isn’t signed in: reconnect from the client and click Allow access again. With an API key, check that the header is present, typed correctly, and the key wasn’t revoked, then reload the client.

List products

Ask:

List my products with list_products.

Empty is fine in a fresh test account — a successful empty list still proves auth and tool discovery work. (list_products takes no filters today.)

Create something in test mode

In test mode (your account was in test mode when you clicked Allow access, or you use a pk_test_… key):

Create a $19 product called “MCP Starter Kit” and give me a checkout link.

The agent should call create_product then create_checkout_session and return a hosted checkout URL. Open it to confirm the sandbox product.

Handy prompts

Goal	Say
Recent sales	”List my last 10 orders and their totals.”
Subscriptions	”Which subscribers are past due?”
Discount	”Create a 20% off code LAUNCH that expires in 7 days.”
Refund	_“Refund order `ord_…` and confirm the status.”_
Webhook check	”List my webhooks and send a test event to the first one.”
Newsletter	”Draft a post announcing the new product — don’t send yet.”

Destructive or expensive actions (refunds, deletes, live sends) deserve an explicit confirmation in the chat. Stay in test mode until the flow is trusted.

4. Verify without an AI client

You can hit the same endpoint with curl to isolate client vs. server issues. curl can’t run the browser sign-in, so this uses an API key:

curl https://api.pocketsflow.com/mcp \
  -H "Authorization: Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_account",
      "arguments": {}
    }
  }'

A JSON result with account fields means the key and endpoint are healthy — if the AI client still fails, re-check its config and reload.

Troubleshooting

Symptom	Likely fix
Tools never appear	Reload / fully quit the client; confirm JSON is valid; for Claude Desktop ensure Node/`npx` is on `PATH`.
`401` / “API key”	Signed-in connection: reconnect from the client (Claude Code: `/mcp` → Authenticate) and click Allow access. Deleting the app’s `MCP: …` key also disconnects it. API key: missing `Bearer` prefix, wrong env var, or revoked key.
Browser never opens to sign in	The client doesn’t support MCP OAuth. Use the API-key header variant for that client.
”The authorization request expired”	Sign-in links last 5 minutes. Start the connection again from your AI app.
ChatGPT can’t reach the server	Must be public HTTPS — `https://api.pocketsflow.com/mcp` already is. Localhost URLs will not work.
Writes affect live data	Your account was in live mode when you clicked Allow access: delete the `MCP: …` key, switch to test mode, and connect again. With a key, switch the config to `pk_test_…` and reload.
Claude Desktop drops the server	Config only accepts stdio — use the `mcp-remote` block above, not a bare `url` field.

MCP server — tool catalog and transport details
Authentication & security
Developer setup
Claude Code + Pocketsflow
Cursor + Pocketsflow
Windsurf + Pocketsflow

Integrations

Developer & AI tools

Endpoint

1. How signing in works

Alternative: API key (headless / CI)

2. Add the server to your client

3. First tool call walkthrough

Handy prompts

4. Verify without an AI client

Troubleshooting

Endpoint

​1. How signing in works

​Alternative: API key (headless / CI)

​2. Add the server to your client

​3. First tool call walkthrough

​Handy prompts

​4. Verify without an AI client

​Troubleshooting

​Related topics

1. How signing in works

Alternative: API key (headless / CI)

2. Add the server to your client

3. First tool call walkthrough

Handy prompts

4. Verify without an AI client

Troubleshooting

Related topics