Docs & FAQ

What is mcpchannel.ai?

A marketplace and proxy gateway for MCP servers and agents. As a provider you publish your MCP listing once. Consumers subscribe and the platform gateway routes all their tool calls to your server — handling auth, metering, and billing.

What is the gateway?

Every consumer tool call goes through the mcpchannel.ai gateway before reaching your server. The gateway authenticates the consumer, injects any OAuth token or provider headers, enforces usage caps, and records metered usage. Your server only has to handle the tool call itself.

What does a request to my MCP server look like?

POST https://your-mcp-server.com/mcp
Authorization: Bearer <consumer-oauth-token>   ← injected by gateway (if OAuth enabled)
X-MCP-Market-Verification: mkt_v1_abc9f3...    ← platform-generated, always sent
X-Provider-Key: your-static-secret              ← from your Provider auth headers (if set)
Content-Type: application/json

{"jsonrpc":"2.0","method":"tools/call","params":{"name":"your_tool","arguments":{}}}

What are Provider auth headers?

Static key-value headers you configure once on your listing. The gateway sends them on every request to your MCP server — introspection, tool calls, everything. Use them so your server can verify that requests are coming from the gateway.

When should I add Provider auth headers?

Any time your MCP server requires authentication before accepting requests. If your server is open to the internet with no auth, you don't need them — but it's strongly recommended to add at least one so random internet traffic can't call your tools.

What header name should I use?

If OAuth is enabled, avoid Authorization — the gateway overwrites it with the consumer's live Bearer token. Use X-Provider-Key instead.

How do I verify Provider auth headers on my server?

// Express / Node.js
const key = req.headers["x-provider-key"];
if (key !== process.env.PROVIDER_SECRET) {
  return res.status(401).json({ error: "Unauthorized" });
}

# Flask / FastAPI
key = request.headers.get("X-Provider-Key")
if key != os.environ.get("PROVIDER_SECRET"):
    return jsonify({"error": "Unauthorized"}), 401

// net/http
key := r.Header.Get("X-Provider-Key")
if key != os.Getenv("PROVIDER_SECRET") {
    http.Error(w, "Unauthorized", http.StatusUnauthorized)
    return
}

What is X-MCP-Market-Verification?

A platform-generated secret unique to your listing. The gateway always injects it. Your server can check it to confirm that requests came through the marketplace gateway — not from someone calling your MCP directly.

How is it different from Provider auth headers?

How do I check X-MCP-Market-Verification on my server?

const verify = req.headers["x-mcp-market-verification"];
if (verify !== process.env.MCP_MARKET_VERIFICATION_TOKEN) {
  return res.status(401).json({ error: "Not from marketplace" });
}

import os
verify = request.headers.get("X-MCP-Market-Verification")
if verify != os.environ.get("MCP_MARKET_VERIFICATION_TOKEN"):
    return jsonify({"error": "Not from marketplace"}), 401

import "os"
verify := r.Header.Get("X-MCP-Market-Verification")
if verify != os.Getenv("MCP_MARKET_VERIFICATION_TOKEN") {
    http.Error(w, "Not from marketplace", http.StatusUnauthorized)
    return
}

Copy the verification secret from the Market verification section on your listing's edit page after saving.

What is Consumer OAuth?

An optional flow where each consumer authenticates with their own identity before calling tools. The gateway fetches a fresh Bearer token per consumer and injects it as Authorization: Bearer <token> on every request to your server. Your server validates the token to know which user is calling.

When should I enable Consumer OAuth?

What is the difference between client_credentials and authorization_code?

How does authorization_code work with GitHub? (provider sets up once)

Provider OAuth credentials storage is coming soon. Currently the platform uses client_credentials flow where each consumer provides their own credentials.

How does client_credentials work? (consumer brings their own credentials)

What is the platform's OAuth callback URL?

https://mcpchannel.ai/oauth/callback

// This is the redirect_uri the platform uses during authorization_code flows.
// Register this exact URL in your OAuth provider's app settings
// (GitHub, Google, Slack, etc.) as the allowed redirect URI.

How does the gateway inject the OAuth token?

The gateway calls your Token URL server-to-server, gets a fresh access_token, and injects it as Authorization: Bearer <token> on the request to your MCP. Your server then validates the token against your OAuth provider's /userinfo or introspection endpoint to identify the consumer.

Why can't I use Authorization in Provider auth headers when OAuth is on?

The gateway sets Authorization: Bearer <consumer-token> on every request. If you also put Authorization in your Provider auth headers, the gateway overwrites it — your static key is lost. Use X-Provider-Key instead so both values reach your server without conflict.

How do I validate the OAuth token on my server?

// Call your OAuth provider's userinfo endpoint
const res = await fetch("https://api.github.com/user", {
  headers: { Authorization: req.headers["authorization"] },
});
if (!res.ok) return reply.status(401).send({ error: "Invalid token" });
const user = await res.json();
// user.login = GitHub username, user.id = GitHub user ID

import httpx
token = request.headers.get("Authorization")
r = httpx.get("https://api.github.com/user",
               headers={"Authorization": token})
if r.status_code != 200:
    return jsonify({"error": "Invalid token"}), 401
user = r.json()  # user["login"] = GitHub username

token := r.Header.Get("Authorization")
req, _ := http.NewRequest("GET", "https://api.github.com/user", nil)
req.Header.Set("Authorization", token)
resp, err := http.DefaultClient.Do(req)
if err != nil || resp.StatusCode != 200 {
    http.Error(w, "Invalid token", http.StatusUnauthorized)
    return
}

What does the Validate button do?

It calls your MCP's introspection endpoint (tools/list, prompts/list, resources/list) using the URL and headers you've configured, and reports back how many tools, prompts, and resources were found. This confirms the gateway can reach your server before you publish.

My MCP requires OAuth — how do I validate it?

Expand the Consumer OAuth section, enter your Token URL, Client ID, and Client Secret, then click Fetch token. The token fills in automatically. Then click Validate — the gateway calls your server with that token in the Authorization header.

Validation fails with 'Could not reach Token URL'

The token fetch goes server-to-server (Next.js → your OAuth server), so CORS is not an issue. Check that: (1) your OAuth server is running, (2) the Token URL is correct and publicly reachable, (3) your Client ID and Secret are valid.

Validation fails with 401 Unauthorized

Your MCP server rejected the request. Check that the Provider auth headers match what your server expects, and if OAuth is on, that the fetched token is valid and your server's token validation logic is correct.

Static API key only (no OAuth)

Per-user OAuth with GitHub

System-to-system with client_credentials (no user login)

Maximum security — both Provider key and Market verification