Magento
Connect Magento to manage products, categories, inventory, orders, invoices, shipments, customers, and sales rules.
You end up pasting your storefront URL plus the Access Token that Magento shows once, in the "Integration Tokens for Extensions" dialog, when you activate a new integration.
- Setup time
- 10 min
- Auth
- API credentials
- API base URL
- https://<your-store-domain>/rest/V1
Before you begin
- Magento Open Source or Adobe Commerce 2.x with an HTTPS storefront
- An Admin user whose role includes System → Extensions → Integrations. The Administrators role has it
- Your own Admin password. Magento re-prompts for it before saving an integration
- Ability to change Stores → Configuration and flush the cache. On 2.4.4 and newer, standalone bearer tokens are off by default
Get your credentials
Open the Integrations grid and add a new integration
In the Admin sidebar go to System → Extensions → Integrations, then click Add New Integration.
Integrations
Third-party systems allowed to call this store's API.
| Name | Status | Activate | Delete | |
|---|---|---|---|---|
| Warehouse syncops@example.com | ops@example.com | Active | Reauthorize | Delete |
| Reporting exportdata@example.com | data@example.com | Inactive | Activate | Delete |
This grid is also where you later reauthorize or delete the integration.
Name the integration and confirm your password
On the Integration Info tab enter a Name such as PopMCP and a contact Email. Leave Callback URL and Identity link URL blank, then type your admin password under Your Password.
Grant resource access on the API tab, then Save
Click the API tab and set Resource Access to All, or pick Custom and tick Sales, Catalog, Customers and Marketing. Click Save.
New Integration
PopMCP
The integration is created as Inactive. Activation happens back on the grid.
Activate it and copy the Access Token
On the grid, click Activate in the integration's row and confirm with Allow. Copy the Access Token from the Integration Tokens for Extensions dialog, then click Done.
Integrations
PopMCP has been activated.
Only the Access Token goes into PopMCP. The dialog does not come back.
Allow the token to be used as a standalone bearer token
Go to Stores → Settings → Configuration → Services → OAuth → Consumer Settings and set Allow OAuth Access Tokens to be used as standalone Bearer tokens to Yes. Click Save Config, flush the cache, then paste your storefront URL and the Access Token into PopMCP.
OAuth
Scope: Default Config
Flush the Magento cache after saving. PopMCP appends /rest/V1 to the store URL for you.
Connect in PopMCP
Open your workspace, choose Magento in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Store URLtext | Your storefront base URL (e.g. https://store.example.com). We append /rest/V1 automatically. You can also paste the full REST base and we'll trim it. HTTPS is required. This is the store the MCP is locked to. |
| Integration Access Tokensecret | Magento Admin → System → Extensions → Integrations → Add New Integration → name it, open the API tab and grant resource access → Save → click Activate → copy the "Access Token". Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Magento immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows the Magento connector as Connected, echoes back your store URL, and a product or order listing tool returns real rows from your catalogue.
Troubleshooting
Every call returns 401 "The consumer isn't authorized to access %resources"
Why: Standalone bearer-token use is disabled, which is the default on Magento 2.4.4 and later.
Fix: Open Stores → Configuration → Services → OAuth → Consumer Settings, set the standalone Bearer tokens option to Yes, click Save Config, then flush the Magento cache.
404 on every endpoint
Why: The store URL was entered with a path already appended, or the store runs on a non-default store code so the REST route is /rest/<store_code>/V1.
Fix: Enter only the origin, for example https://store.example.com. If your install uses store codes in URLs, use the store view's base URL so the code resolves.
403 on some resources but not others
Why: The integration was saved with Custom resource access and the required tree node was not ticked.
Fix: Open System → Extensions → Integrations → Edit → API tab, set Resource Access to All or tick the missing branch, click Save, then click Reauthorize on the grid.
You clicked Done without copying the Access Token
Why: The Integration Tokens for Extensions dialog is shown only at activation.
Fix: Click Reauthorize on the integration row. Magento issues a fresh token set and shows the dialog again. The old token stops working.
The connection is refused for using http://
Why: PopMCP requires HTTPS for the store URL.
Fix: Put a valid TLS certificate on the storefront and set the secure base URL in Stores → Configuration → General → Web.
Saving the integration fails with a password error
Why: Magento re-verifies the signed-in admin's identity before writing the integration.
Fix: Retype your own admin password in the Your Password field on the Integration Info tab, not the password of the account the integration represents.