FiveX MCP key
Copy keys from the FiveX MCP setup screen and send Authorization: Bearer <FIVEX_MCP_KEY> with MCP requests.
MCP security
Permissions, approvals and security for FiveX MCP
FiveX MCP is designed so AI agents can access commerce context without making access invisible. Authentication, channel permissions and approval boundaries control what an agent can read or change.
Commerce automation should be controlled and permissioned. Start with read access, enable only the channels you need, and require approval for operational actions.
Authentication
Authenticate every MCP client
Treat MCP credentials as private runtime secrets. Do not commit keys, print them in logs or store them in source control.
OAuth when supported
Some MCP clients can use an OAuth flow instead of a manually pasted bearer token.
API tokens
Manual clients can use API tokens from the setup screen when they need explicit bearer-token configuration.
Revocation and rotation
Rotate or revoke credentials from the FiveX account when a client is retired or a secret may have been exposed.
Channel access
Channel permissions stay explicit
Connecting a channel to FiveX is not the same as exposing it to AI. MCP channel access stays disabled until your team enables it.
Disabled by default
AI agents cannot use a connected channel until channel access is enabled in the MCP setup.
Least privilege
Enable only the marketplaces, advertising accounts and ecommerce systems the agent needs.
Workspace isolation
Access is scoped to the authenticated FiveX account and the channels enabled for that workspace.
Access model
Read first, write only when permitted
Having data in FiveX, having an API capability, exposing an MCP tool and allowing an action are not automatically the same thing.
Read
Retrieve commerce context such as performance, inventory, advertising and profitability signals when tools are available.
Analyze and recommend
The AI client can combine returned context and suggest next actions without executing changes.
Act
Operational changes require an available write tool, enabled channel permissions and explicit approval for the exact action.
Approvals
Require confirmation for operational changes
Do not let an agent execute write actions until a person has approved the exact change and channel scope.
Approve the action
Confirm the proposed change, affected channel and expected outcome before execution.
Keep credentials private
Never ask an agent to store MCP keys in repositories, prompts that will be shared, or durable logs.
Pair with API governance
Use the security governance guide for broader token handling and operational controls.
Governance
Safe commerce action flow
When an AI agent proposes a change, FiveX should only support execution through a controlled path.
AI action request
The agent proposes a change based on retrieved commerce context.
Permissions and tools
FiveX checks whether the relevant MCP tools and channel permissions are available.
Approval
A person confirms the exact action before any operational write proceeds.
Execution
Only then can a supported action run against the connected channel.
Review security before expanding write access.
Connect with least privilege, verify read workflows, then enable approved actions carefully.