> For the complete documentation index, see [llms.txt](https://developer.paddle.com/llms.txt).

# Connect the live Paddle MCP server with OAuth

The live Paddle MCP server now supports OAuth. Connect from Claude, Cursor, Codex, and other clients by authorizing in your browser, with no API key to manage. Sandbox continues to use an API key.

---

## What's new?

We updated the live [Paddle MCP server](https://developer.paddle.com/sdks/ai/paddle-mcp.md) to support OAuth. Instead of creating an API key and pasting it into your client config, you authorize your agent's access in your browser.

The sandbox MCP server continues to use Bearer authentication using an API key.

## How it works

The Paddle MCP server lets AI agents interact with your Paddle account. Instead of navigating the dashboard or making API calls, you can ask an agent in natural language to handle pricing, billing, support, and integration workflows.

Previously, you needed to create an API key and configure your MCP server to use it as a Bearer token.

Today, we updated the live MCP server to support OAuth. When your agent first uses the server, the client opens your browser, you sign in to Paddle and approve access, and the connection is authorized.

| Environment | URL                                                           | Authentication     |
| ----------- | ------------------------------------------------------------- | ------------------ |
| Sandbox     | `https://sandbox-mcp.paddle.com/mcp` | API key            |
| Live        | `https://mcp.paddle.com/mcp`         | OAuth, or API key  |

### Authentication and permissions

{% callout type="warning" title="AI agents can make mistakes" %}
The Paddle MCP server has access to the data in your account. Review every action the agent takes before and after execution.
{% /callout %}

By default, a live MCP server connected with OAuth has **read** access to whatever your Paddle user account's role permits. Once connected, you can view and change permissions for an MCP server in the dashboard under **Paddle > Connectors > MCP**.

For security, you may be asked to reauthorize from time to time.

### API keys are still available

OAuth is the recommended way to connect to live, but you can still authenticate using a live API key as a Bearer token. This is useful for automated environments where a browser sign-in isn't practical. See [Install the MCP server](https://developer.paddle.com/sdks/ai/paddle-mcp#install-the-mcp-server.md) for details.

## Next steps

OAuth is available now for the live server across all MCP-compatible clients. If you use one of our [official Paddle plugins](https://developer.paddle.com/sdks/ai/agent-skills.md) for Claude Code, Codex, Cursor, or Gemini CLI, update your plugin to pick up the change.

If you're already using the live Paddle MCP server with an API key, we recommend switching to OAuth. API key authentication continues to work, so your existing workflows won't be impacted.

See [Paddle MCP server](https://developer.paddle.com/sdks/ai/paddle-mcp.md) for install instructions, details about authorization, and example prompts.