Analytics MCP server: connecting a third-party application with the customer's own OAuth User credentials

[romone22]

Hello,

Adobe Developer Support lists this repository as a support channel for Adobe Analytics, so I am asking here — happy to move the question if there is a better place.

Context. We operate allmates.ai, an enterprise AI assistant platform. Several of our customers run Adobe Analytics and Customer Journey Analytics and want to use your MCP servers (https://aa-mcp.adobe.io/mcp, https://cja-mcp.adobe.io/mcp) from our product.

The dynamic client registration endpoint advertised in your authorization-server metadata only accepts an allowlist of partner redirect URIs (claude.ai, chatgpt.com, cursor.com, plus loopback), so our own callback is rejected. That is fine — rather than asking to be added to that list, we would like to follow what looks like the intended path for customers: each customer creates its own OAuth application and we use those credentials.

The setup we plan to document for our customers:

1. An Adobe administrator adds the "MCP Access" permission item to the relevant product profile, and adds the developer on the Developers tab.
2. That developer creates a Developer Console project, adds the Adobe Analytics (or CJA) API, and creates an OAuth User authentication / Web App credential.
3. They declare our redirect URI in that credential and hand us the client ID and client secret.
4. Our platform runs the authorization-code + PKCE flow against ims-na1.adobelogin.com, requesting openid AdobeID additional_info.projectedProductContext, and each of their users signs in with their own Adobe ID.

Questions:

1. Is this a supported way to reach the MCP servers — i.e. does the MCP server accept an IMS user token issued to a client credential it did not register itself?
2. With a user token, are the x-api-key and x-gw-ims-org-id headers expected, as they are in the documented server-to-server flow? Is x-global-company-id required for Adobe Analytics, or is setSessionDefaults the intended way to select the company?
3. User-authentication credentials start "In Development", where only listed beta users can sign in, and your documentation states that an application can serve Adobe users with a company or school account only after an Adobe review. Does a customer need that review to let its own employees sign in to its own application? This is the point that decides whether each customer can set this up alone.
4. Are any scopes needed beyond the three above?

Related question on the MCP documentation repository: AdobeDocs/analytics-mcp#12.

Thank you,
Romain Chaumais — allmates.ai