Authentication
The Operators MCP uses OAuth authentication:- You log in with your existing Shopify credentials
- No API keys to manage or rotate
- Access is scoped to your store only, no other merchant’s data is accessible
- Sessions can be revoked from Integrations
OAuth access levels
When you connect an AI client, the consent screen asks which access level to grant:
Full access is selected by default. Choose Read only when you want an AI assistant to search and inspect data but not change anything in Supercycle.
If the client already requested read-only access, the consent screen shows that level with no choice to widen it.
Read-only connections can call list and get tools (
list_cycles, get_cycle, list_items, and the other read tools). Write tools — update_cycle, create_return, update_return, add_tag, remove_tag, add_comment, and create_blocked_date — return an Insufficient scope error. Reconnect and choose Full access to use them.
Deactivating an OAuth client in Integrations immediately blocks all of its tokens, including ones that were already issued.
Approval flows
The Operators MCP uses MCP safety annotations to protect your data:- Read operations: Auto-approved for seamless searching and viewing of cycles, inventory, charges, and customers.
- Write operations: Request user confirmation before creating, updating, or deleting data.
Data access
- The MCP only operates within your store’s data
- You have the same data access as your Supercycle admin account
- No data is shared with external systems unless you explicitly configure integrations
- All operations are performed through the Supercycle API with standard rate limits and validation
Best practices
- Review write operations - Always read the confirmation prompt before approving changes from your AI tool
- Revoke sessions when needed - If a team member leaves or access should be removed, revoke their session from Integrations