What's new?
We updated the live Paddle MCP server to support OAuth. Instead of creating an API key and pasting it into your client config, you authorize your agent's access in your browser.
The sandbox MCP server continues to use Bearer authentication using an API key.
How it works
The Paddle MCP server lets AI agents interact with your Paddle account. Instead of navigating the dashboard or making API calls, you can ask an agent in natural language to handle pricing, billing, support, and integration workflows.
Previously, you needed to create an API key and configure your MCP server to use it as a Bearer token.
Today, we updated the live MCP server to support OAuth. When your agent first uses the server, the client opens your browser, you sign in to Paddle and approve access, and the connection is authorized.
| Environment | URL | Authentication |
|---|---|---|
| Sandbox | https://sandbox-mcp.paddle.com/mcp | API key |
| Live | https://mcp.paddle.com/mcp | OAuth, or API key |
Authentication and permissions
AI agents can make mistakes
The Paddle MCP server has access to the data in your account. Review every action the agent takes before and after execution.
By default, a live MCP server connected with OAuth has read access to whatever your Paddle user account's role permits. Once connected, you can view and change permissions for an MCP server in the dashboard under Paddle > Connectors > MCP.
For security, you may be asked to reauthorize from time to time.
API keys are still available
OAuth is the recommended way to connect to live, but you can still authenticate using a live API key as a Bearer token. This is useful for automated environments where a browser sign-in isn't practical. See Install the MCP server for details.
Next steps
OAuth is available now for the live server across all MCP-compatible clients. If you use one of our official Paddle plugins for Claude Code, Codex, Cursor, or Gemini CLI, update your plugin to pick up the change.
If you're already using the live Paddle MCP server with an API key, we recommend switching to OAuth. API key authentication continues to work, so your existing workflows won't be impacted.
See Paddle MCP server for install instructions, details about authorization, and example prompts.