- “Which carts were abandoned today, and what was in them?”
- “Show me cart #1042 and log that we called the customer.”
- “Turn cart #1042 into a draft order for Jane Doe and add two more of the blue mug.”
Turn it on
Go to Settings → MCP Integration.- Check the Status badge. If it says Disabled, click Turn on.
- Copy the MCP server URL with the Copy button. You’ll need it to connect your assistant.
Create an access token
1
Name the token
Under Create an access token, enter a Token name that says who or what uses it — for example Claude Desktop — read only.
2
Choose the tools
Under Tools this token can use, tick the tools this token may call. Tools are grouped into Read and Write (mutating). Hover the ⓘ icon next to a tool to see what it does.Shortcuts: Select all, Read-only (every read tool, no write tools) and Clear.
3
Set an expiry
Choose Never expires, 30 days, 60 days, 90 days, or Custom date… and pick a date.
4
Create and copy
Click Create token. A yellow banner shows the full token once — click Copy token and store it somewhere safe, such as a password manager.The banner also includes a ready-made Claude Desktop config with your token filled in. Click Copy config to grab it.
Connect your assistant
- Claude Desktop
- Cursor, ChatGPT & others
- In Claude Desktop, open Settings → Developer → Edit Config.
- Add the block below to
claude_desktop_config.json(or paste the config you copied when you created the token). - Replace the URL and
<YOUR_TOKEN>with your values, save the file, and restart Claude Desktop.
claude_desktop_config.json
This uses
npx, so Node.js must be installed on the computer running Claude Desktop.Manage your tokens
Your tokens lists every token:
Actions:
- Disable / Enable — pause a token without deleting it.
- Revoke — delete the token permanently. Confirm with Yes.
Security best practices
Least privilege
Give each token only the tools it needs. Start with Read-only and add write tools only when you need them.
One token per assistant
Create a separate token for each person or tool, so you can revoke one without affecting the others.
Set an expiry
Use 30–90 day expiries for anything other than long-term, trusted setups.
Treat tokens like passwords
Never paste a token into a chat, email or shared document. If one leaks, revoke it straight away.