Store

Store MCP Setup

Connect your AI client to the TimeBack Store's MCP server so you can publish your listing, set pricing, and run promos conversationally. The MCP endpoint is:

https://api.store.timeback.com/mcp/v1

The Store MCP requires you to sign in — on first connection your client opens a Google SSO popup. Sign in with a Google account that already has Store-admin access for your app (Store-admin access is granted when your app is promoted from draft to active and listed in the Store).

Cursor

In ~/.cursor/mcp.json:

{
  "mcpServers": {
    "timeback-store": {
      "url": "https://api.store.timeback.com/mcp/v1"
    }
  }
}

Restart Cursor; the SSO popup opens on the first tool call.

VS Code

In .vscode/mcp.json at the root of your workspace (or ~/.config/Code/User/mcp.json for a user-level binding):

{
  "servers": {
    "timeback-store": {
      "type": "http",
      "url": "https://api.store.timeback.com/mcp/v1"
    }
  }
}

Reload the window; VS Code prompts to authorize the server on its first invocation.

Claude Code 

claude mcp add --transport http timeback-store https://api.store.timeback.com/mcp/v1

The next prompt that uses a timeback-store tool triggers the SSO popup.

ChatGPT

Open Settings → Connectors → Add custom connector, name it TimeBack Store, and paste the URL above as the MCP server URL. ChatGPT opens the SSO popup the first time you invoke a tool from the connector.

Tools at a Glance

register_app, update_app_plan, create_catalog_item, manage_app_image, set_app_published, list_discount_codes, create_discount_code, create_affiliate, update_affiliate, refund_purchase.

See Store → Integration for what each tool does and how to combine them with the runtime entitlement check at app launch. refund_purchase is documented on Store → Refunds.

What You Get Back From register_app

register_app returns credentials your app needs for the Store's runtime REST surface — capture them on first registration; the secret values are shown once and are not retrievable through subsequent MCP calls:

  • cognitoClient.clientId + cognitoClient.clientSecret — Cognito M2M client credentials for the OAuth 2.0 client-credentials flow that authenticates calls to POST /apps/v1/purchases. The scope is https://store.timeback.com/apps/v1/purchases.write.
  • outboundWebhookSigningSecret — returned only when you set a webhookUrl at registration time. Your app uses it to verify the HMAC-SHA256 signatures on outbound webhook deliveries.

See Store → In-App Purchases for how these credentials are used end-to-end.

Related Docs

Store → Introduction

What the Store provides, the publish path, and the prerequisites.

Store → Integration

The full Store MCP tool surface and the "check student access at login" runtime pattern.

Store → In-App Purchases

Use the M2M credentials returned by register_app to call the purchase endpoint and verify outbound webhook deliveries.

Store → Refunds

Refund flows and the refund_purchase MCP tool.

Previous
Introduction
Next
Integration