> ## Documentation Index > Fetch the complete documentation index at: https://docs.gc.ai/llms.txt > Use this file to discover all available pages before exploring further. # Provision MCP Client-credentials > Mint an OAuth 2.0 client-credentials credential so a machine client (e.g. Salesforce AgentForce) can obtain org-scoped MCP access tokens. Requires an **org-scoped** API key (`gcai_...`); user-scoped keys receive 403. The organization's single M2M application is created on first call and reused thereafter, so this endpoint is safe to call repeatedly. Each call mints a **new** secret and returns it **once** (it cannot be retrieved again). A WorkOS application allows up to 5 live credentials; once that limit is reached the identity provider rejects further mints (returned here as 502) until an existing credential is revoked. Hand the returned `client_id`, `client_secret`, `token_endpoint`, and `resource` to the machine client's OAuth configuration. ## OpenAPI ````yaml POST /mcp/credentials openapi: 3.0.3 info: title: GC AI External API version: 1.0.0 description: >- The GC AI External API allows programmatic access to GC AI's chat capabilities. It's designed for integration with workflow automation tools like Zapier, Make, n8n, or custom applications. ## Authentication All API requests must include an API key in the `Authorization` header: ``` Authorization: gcai_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ``` API keys can be created in the GC AI app under **Settings → API**. ## Multi-turn Conversations Conversations can span multiple turns: pass the `chat_id` returned by a completion back on your next request to continue the same chat. See [Multi-turn Conversations](/api-reference/concepts/multi-turn). ## Current Limitations The following is not yet available via API: - **Interactive clarification**: the model cannot pause to ask the caller a follow-up question; the `askUserQuestions` tool is disabled on the API surface ## Usage Usage is tracked and viewable in the GC AI app under **Settings → API → View Usage**. ## Support For API support, contact [support@gc.ai](mailto:support@gc.ai) or reach out to your account representative. contact: email: support@gc.ai servers: - url: https://app.gc.ai/api/external/v1 description: Production server security: [] tags: - name: Async Jobs description: Poll the status and result of asynchronous API jobs - name: Chat description: AI chat completion endpoints - name: Files description: File upload and management endpoints - name: Folders description: Folder management endpoints - name: Playbooks description: Playbook review endpoints - name: Profiles description: Personal and company profile endpoints - name: Projects description: Project management endpoints - name: Skills description: Skill library management endpoints - name: Utility description: Health check and connectivity endpoints - name: Usage description: Usage and credit/billing reporting endpoints paths: /mcp/credentials: post: tags: - MCP summary: Provision MCP client-credentials description: >- Mint an OAuth 2.0 client-credentials credential so a machine client (e.g. Salesforce AgentForce) can obtain org-scoped MCP access tokens. Requires an **org-scoped** API key (`gcai_...`); user-scoped keys receive 403. The organization's single M2M application is created on first call and reused thereafter, so this endpoint is safe to call repeatedly. Each call mints a **new** secret and returns it **once** (it cannot be retrieved again). A WorkOS application allows up to 5 live credentials; once that limit is reached the identity provider rejects further mints (returned here as 502) until an existing credential is revoked. Hand the returned `client_id`, `client_secret`, `token_endpoint`, and `resource` to the machine client's OAuth configuration. operationId: provisionMcpCredentials responses: '200': description: A newly minted credential (secret shown once) content: application/json: schema: $ref: '#/components/schemas/McpCredentialResponse' '401': description: Missing or malformed API key content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Key is not org-scoped, or the API key is invalid content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: MCP is not configured for this deployment content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Rate limit exceeded. See [Rate Limits](/api-reference/concepts/rate-limits) for the tiers, limits, and how to back off. headers: Retry-After: schema: type: string description: Seconds to wait before retrying after a rate-limit block. example: '60' required: true description: Seconds to wait before retrying after a rate-limit block. RateLimit-Limit: schema: type: string description: Request quota for the applicable window. example: '3' required: true description: Request quota for the applicable window. RateLimit-Remaining: schema: type: string description: Requests remaining in the current window. example: '0' required: true description: Requests remaining in the current window. RateLimit-Reset: schema: type: string description: Seconds until the quota resets. example: '60' required: true description: Seconds until the quota resets. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' '502': description: >- The identity provider failed to provision the credential (includes the 5-credential limit being reached) content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: Service temporarily unavailable headers: Retry-After: schema: type: string description: >- Seconds to wait before retrying after a transient service outage. example: '5' required: true description: >- Seconds to wait before retrying after a transient service outage. content: application/json: schema: $ref: '#/components/schemas/Error' security: - ApiKeyAuth: [] components: schemas: McpCredentialResponse: type: object properties: client_id: type: string description: >- The M2M application's client ID. Stable across rotations; configure it as the OAuth client ID in Salesforce. example: client_01HXWKHA5SX0JZYAD037JBE3PT client_secret: type: string description: >- The client secret for the client-credentials grant. Shown only once, here, at creation. Store it securely; it cannot be retrieved again. token_endpoint: type: string format: uri description: >- The OAuth 2.0 token endpoint to exchange the credential for an access token (`grant_type=client_credentials`). example: https://your-org.authkit.app/oauth2/token resource: type: string format: uri description: >- The MCP resource URL to send as the `resource` parameter on the token request (OAuth 2.1). Also the MCP endpoint the issued token is used against. example: https://app.example.com/api/mcp grant_type: type: string enum: - client_credentials description: The OAuth 2.0 grant type to use with this credential. required: - client_id - client_secret - token_endpoint - resource - grant_type Error: type: object properties: error: type: string description: Error message code: type: string description: >- Machine-readable error code present on some errors (e.g. `RATE_LIMITED`, `INSUFFICIENT_CREDITS`, `TRIAL_NOT_STARTED`, `BILLING_NOT_CONFIGURED`). Branch on this rather than the human-readable `error` string. message: type: string description: Additional error details details: type: object additionalProperties: nullable: true description: Validation error details (for 400 errors) required: - error securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: |- API key for authentication. Format: `gcai_xxxxxxxxx` Create API keys in the GC AI app under Settings → API. ````