Connect and authenticate

Connect a compatible MCP client to the Bluestone PIM product MCP server, then sign in through Bluestone's interactive OAuth flow. Do not put a Management API key, client secret, or copied bearer token in the MCP server configuration.

The product MCP server can operate on PIM data with your permissions. If you only need published API documentation, use the Bluestone PIM docs MCP server instead.

Before you connect

You need:

• A Bluestone PIM user account with access to the organization you intend to use
• An MCP client that supports remote servers over Streamable HTTP
• Client support for interactive OAuth, including browser-based authorization
• The product MCP endpoint supplied for your environment

Use the Production EU product MCP endpoint:

https://mcp-core-public.bluestonepim.com/mcp

Do not derive a production or regional endpoint from this hostname.

Add the server

The setting names vary by client, but the connection uses these values:

In a graphical client:

1. Add a custom or remote MCP server.
2. Select HTTP or Streamable HTTP.
3. Enter the endpoint URL and save the connection.
4. Start the connection and choose the client's Authenticate or Sign in action.
5. Complete Bluestone sign-in in the browser and return to the client.

Configuration-based clients

Many clients accept an mcpServers object. Confirm the exact schema in your client's documentation before using this example:

{
  "mcpServers": {
    "bluestone-pim": {
      "type": "http",
      "url": "https://mcp-core-public.bluestonepim.com/mcp"
    }
  }
}

For Claude Code, add the remote server with:

claude mcp add --transport http bluestone-pim https://mcp-core-public.bluestonepim.com/mcp

Open /mcp in Claude Code and complete authentication if it does not begin automatically.

How authentication works

The endpoint uses an OAuth 2.1-based authorization flow. A compatible client discovers the protected-resource and authorization-server metadata, dynamically registers when needed, and completes an authorization-code flow with PKCE S256 in the browser. The server supports refresh tokens so a client can maintain an authorized session.

The authorization server exposes one OAuth scope, mcp. It does not provide separate scopes for read/write operations or individual tool groups. Each operation is authorized using the signed-in user’s organization and Bluestone permissions.

You should not need to handle those protocol messages manually. In particular:

• Do not paste a Management API key or bearer token into the MCP configuration.
• Do not share access tokens, refresh tokens, authorization codes, browser callback URLs, or exported client credentials.
• Verify the Bluestone user and, where the flow displays it, the organization before approving access.
• Treat the connected client like an authenticated Bluestone PIM session.

Reconnect, change user, or sign out

MCP clients store and clear OAuth state differently. Use the client's MCP connection controls to disconnect, clear authentication, or sign out. Then reconnect and complete the browser flow again when you need to:

• Change the Bluestone user or organization
• Recover from an expired or revoked authorization
• Remove access from a shared or decommissioned device

Closing a chat is not necessarily the same as signing out of the MCP server. Confirm that the client has removed the stored authorization when access must be revoked locally.

Confirm the connection

After sign-in, ask the assistant for a read-only check before authorizing any change:

Show the Bluestone PIM tools available in this connection. Without changing data, report any organization context the server exposes. If it does not expose that context, stop and tell me to verify it in Bluestone PIM. Do not create, update, archive, or delete anything.

Review the result and the client's proposed tool calls. Continue with Permissions and safe operation before using write tools.