Post Affiliate Pro includes a built-in MCP server (Model Context Protocol) that lets you connect external AI tools — such as Claude, Cursor, ChatGPT, FlowHunt or any other MCP-compatible client — directly to your Post Affiliate Pro account. Once connected, the AI tool can read your affiliate program data and, if you allow it, make changes on your behalf, using your merchant identity and privileges.
There are two ways to authenticate your MCP client:
- OAuth 2.1 (recommended) — add the MCP server URL to your AI tool, sign in with your merchant login and approve access. No token to copy.
- Bearer token — generate an MCP access token in the merchant panel and paste it into the AI tool manually. Use this only for tools that cannot use OAuth.
Note: The MCP server is available to merchants only. Affiliates cannot connect AI tools to the affiliate panel.
Finding the AI assistants (MCP) screen
- In the merchant panel, navigate to Tools > Integration.
- In the API (Programmatic Access) section, click AI assistants (MCP).
This screen shows the MCP server URL of your account, the AI assistants connected over OAuth and your bearer tokens. Use these values when configuring any MCP-compatible client:
| Setting | Value |
|---|---|
| MCP server URL | https://<your-post-affiliate-pro-domain>/api/mcp — copy the exact URL from the AI assistants (MCP) screen |
| Transport protocol | Streamable HTTP |
| Authentication | OAuth 2.1 (Authorization Code + PKCE) or Bearer token |
Tip: If you use your own domain for Post Affiliate Pro, you can use it in the MCP server URL as well, e.g. https://affiliates.example.com/api/mcp.
Access to the screen requires the API key privilege of your merchant role.
Connecting with OAuth
OAuth lets AI tools such as Claude and Cursor connect to your Post Affiliate Pro account without you having to copy and paste a token. The AI tool registers itself and handles the whole authentication flow automatically.
How it works
- In your AI tool, add a new MCP server (in some tools called a connector) and paste the MCP server URL from the AI assistants (MCP) screen.
- The AI tool opens the Post Affiliate Pro merchant login page. Sign in with your merchant credentials (if you are not signed in already).
- A consent screen shows which application wants to access your account, the merchant you are signed in as and where you will be redirected. Choose the access you want to grant and click Allow. To connect a different merchant, click Sign in with a different account.
- You are redirected back to the AI tool, which is now connected and ready to use.
If you click Deny, the AI tool receives no access to your account.
Read and write access
The consent screen offers two levels of access:
- Read data — affiliates, transactions, campaigns, banners, clicks and reports. Always granted when you click Allow.
- Make changes — e.g. create, update or approve affiliates, create commissions, approve or decline transactions, process refunds and chargebacks. Granted only when you tick the Make changes checkbox. The checkbox is shown only if the AI tool asks for write access.
The access is further limited by your merchant role: the AI tool can never do more than you can do in the merchant panel. If your role has no privileges that can be granted to an AI tool, the consent screen shows an error and no connection is created.
Tip: Grant read-only access when you only want to analyze your data or ask questions about your affiliate program. You can reconnect later with write access if needed.
Managing connected assistants
The Connected assistants grid on the AI assistants (MCP) screen lists all AI tools connected over OAuth, with the following details:
- AI assistant — the name the AI tool registered with
- Access — read, or read and write
- Connected and Last used — when the connection was created and last used
- Expires if unused — when the connection expires if the AI tool does not use it
- User — the merchant who approved the connection
A connection renews automatically each time it is used and expires only after 30 days without use. After that, the AI tool has to go through the OAuth flow again. Click Revoke to disconnect an AI tool immediately — it loses access and has to go through the OAuth flow again to reconnect.
Connecting with a bearer token
Bearer tokens are MCP access tokens you generate in the merchant panel and paste into your AI tool's MCP settings. Use them only with AI tools or scripts that cannot use OAuth.
Generating a bearer token
- On the AI assistants (MCP) screen, scroll to Alternative: bearer tokens and click Generate bearer token.
- Enter a Name that helps you recognize where the token is used.
- Set the Expiration date time. It defaults to 90 days from today. Leave the field blank to create a token that does not expire.
- Select the Access scopes — read and/or write access to affiliates, transactions, campaigns, banners, coupons and direct links, and read access to statistics and settings.
- Click Generate token.
- Copy the token and paste it into your AI tool as the Bearer token value, i.e. as the
Authorization: Bearer <token>header.
Important: The token is displayed only once and cannot be retrieved later. Store it securely as soon as you generate it. If you lose it, revoke the token and generate a new one.
Note: MCP bearer tokens work only with the MCP server, and they are not restricted to IP addresses. API v3 keys cannot be used to connect to the MCP server, and MCP bearer tokens cannot be used with the API v3.
Managing bearer tokens
The bearer token grid shows each token's name, creation date, last use, access scopes, expiration date and the merchant it belongs to. Click Revoke to revoke a token — the AI tool using it loses access immediately. Revoking cannot be undone.
Available tools
The MCP server offers tools for searching and managing affiliates, transactions, campaigns, banners, clicks and reports. Your AI tool sees only the tools allowed by the access you granted: with read-only access, tools that make changes are not offered at all. See the MCP tools reference for the complete list of tools and what each one does.
Permissions and audit trail
All actions performed through an MCP connection — regardless of whether OAuth or a bearer token is used — are performed under your merchant account and are subject to your role's privileges, exactly as if you had performed them in the merchant panel.
Every change made by an AI tool is recorded in Tools > Event logs with the MCP prefix and the ID of the merchant, e.g. MCP (user 11111111): set affiliate 3c5e1a7b status to approved. Approving an OAuth connection is logged as well, together with the name of the AI tool and the granted access, e.g. MCP: authorized application "Claude" with scopes read write.
The MCP server accepts up to 100 requests per minute in total across all MCP connections. When the limit is reached, requests are rejected for up to 60 seconds and the AI tool usually retries on its own.
The account owner (master merchant) can see and revoke the connected assistants and bearer tokens of all merchants. Other merchants see and manage only their own.
Troubleshooting
- The AI tool cannot connect or keeps asking to authorize — make sure the MCP server URL ends with
/api/mcpand matches the URL shown on the AI assistants (MCP) screen. - The consent screen shows Your role has no permissions that can be granted to an AI assistant — your merchant role lacks the privileges needed. Ask the account owner to extend your role or connect with a different merchant.
- The AI tool says a tool is not available — the connection has read-only access or your role lacks the privilege. Reconnect and tick Make changes, or generate a bearer token with the required write scopes.
- A bearer token stopped working — check its expiration date in the bearer token grid and generate a new token if it expired.