Another client

Get your instance’s MCP URL from your administrator or Connect a client in the console. See connection prerequisites and sign-in before starting.

Choose a client that supports remote MCP over Streamable HTTP and Cutova’s OAuth authorization flow. Give it the MCP URL. Clients with discovery support can find the authorization endpoints. For manual configuration, ask your administrator for the values shown in the console’s Other tab. Use the Authorization URL appropriate to your client; the Copilot Studio workaround is not required by every client.

Clients that register themselves and need a client secret, such as a Microsoft 365 Copilot agent built with the Microsoft 365 Agents Toolkit, are supported: Cutova issues the secret during registration. Sign-in still uses PKCE.

Availability can depend on the client’s plan, version, and workspace settings. MCP connectivity, interactive Apps, and skill installation are separate capabilities. Check each capability you need before choosing a client.

Complete the Epicor sign-in and Cutova approval, then try your first tool call.

Automations: agent tokens

Automations that cannot sign in interactively (n8n, Claude Code run unattended, the Agent SDK, scripts) can use an agent token instead of the sign-in flow. An administrator creates one on the instance’s Users tab in the Cutova console (Create agent token), for a specific Epicor user. Calls run as that Epicor user, with that user’s Epicor permissions. The token is shown once; copy it then, because Cutova does not store it.

Send it as a static header on every request to your MCP URL:

Authorization: Bearer <agent token>

• Claude Code: claude mcp add --transport http cutova-<quick code> <your MCP URL> --header "Authorization: Bearer <agent token>". Use a different name per instance (the console’s command uses the instance quick code), or adding a second instance replaces the first.
• n8n: in the MCP Client node, choose Bearer authentication and paste the token.
• Agent SDK or another HTTP client: pass the header in the transport’s headers option.

Agent tokens expire after the lifetime the administrator chose (at most 365 days). A revoked token is refused on its next call; a call already in progress finishes. Each active agent token (not revoked, expired or switched off by your plan) used in the last seven days counts as one active user on your plan. Prefer a dedicated integration Epicor user with only the permissions the workflow needs.