Provision MCP Client-credentials
Mint an OAuth 2.0 client-credentials credential so a machine client (e.g. Salesforce AgentForce) can obtain org-scoped MCP access tokens.
Requires an org-scoped API key (gcai_...); user-scoped keys receive 403. The organization’s single M2M application is created on first call and reused thereafter, so this endpoint is safe to call repeatedly. Each call mints a new secret and returns it once (it cannot be retrieved again). A WorkOS application allows up to 5 live credentials; once that limit is reached the identity provider rejects further mints (returned here as 502) until an existing credential is revoked.
Hand the returned client_id, client_secret, token_endpoint, and resource to the machine client’s OAuth configuration.
Authorizations
API key for authentication. Format: gcai_xxxxxxxxx
Create API keys in the GC AI app under Settings → API.
Response
A newly minted credential (secret shown once)
The M2M application's client ID. Stable across rotations; configure it as the OAuth client ID in Salesforce.
"client_01HXWKHA5SX0JZYAD037JBE3PT"
The client secret for the client-credentials grant. Shown only once, here, at creation. Store it securely; it cannot be retrieved again.
The OAuth 2.0 token endpoint to exchange the credential for an access token (grant_type=client_credentials).
"https://your-org.authkit.app/oauth2/token"
The MCP resource URL to send as the resource parameter on the token request (OAuth 2.1). Also the MCP endpoint the issued token is used against.
"https://app.example.com/api/mcp"
The OAuth 2.0 grant type to use with this credential.
client_credentials