OAuth Flow

1. Claude fetches /.well-known/oauth-authorization-server
2. Claude redirects the user to /authorize with PKCE parameters
3. User enters their warenquelle API key in the authorization form
4. The key is returned as the authorization code to Claude's callback
5. Claude exchanges the code at /token for an access token
6. All subsequent MCP requests include Authorization: Bearer <api_key>

API Key Validation

On each tool call, the backend validates the Bearer token against the wq_mcp_api_keys table:

SELECT MERCH_UUID, MARKET_UUID
FROM wq_mcp_api_keys
WHERE api_key  = :key
  AND is_active = 1

If the key is valid, last_used is updated and the request proceeds scoped to that merchant and market. If invalid or inactive, the backend returns HTTP 403.

API Key Format

Property	Value
Format	wq_live_ + 24 random characters
Length	max. 64 characters
Scope	One key per merchant + market combination
Revocation	Set is_active = 0 to immediately revoke

OAuth Callback URLs

The following redirect URIs are allowlisted:

https://claude.ai/api/mcp/auth_callback
https://claude.com/api/mcp/auth_callback