Machine-to-machine integration

For services and automation pipelines that need to call Solibo Home MCP without a user signing in, Solibo provisions a dedicated OAuth client plus a backend client_user mapping. Those credentials are used for the MCP endpoint itself: your service gets a bearer token from the Solibo auth domain, then sends MCP JSON-RPC requests directly to the MCP server.

You do not need to call private Solibo Home backend endpoints directly, and you do not need a Solibo-specific SDK to use this flow.

How it works

  1. Your service authenticates against the Solibo auth domain with client_credentials.
  2. Cognito issues an access token with the granted solibo.mcp/* scopes.
  3. Your service calls the Solibo Home MCP endpoint with Authorization: Bearer <access_token>.
  4. The MCP server validates the token and forwards it to Solibo Home.
  5. The Solibo Home backend resolves the service identity from the provisioned client_user mapping and enforces access.
Service -> auth.home.solibo.no/oauth2/token (client_credentials) -> access token
Service -> POST https://mcp.home.solibo.no (Bearer token) -> MCP tools
MCP server -> Solibo Home backend (same bearer token)

Endpoints

Environment Token endpoint MCP endpoint
Production https://auth.home.solibo.no/oauth2/token https://mcp.home.solibo.no
Development https://auth.rearden.dev.solibo.io/oauth2/token https://mcp.dev.solibo.io

Credentials

Contact Solibo to provision an M2M client. You will receive:

  • A Cognito client_id
  • A Cognito client_secret when the provisioned client uses one
  • A backend client_user configuration that defines which companies and data the client can access
  • The scopes granted to the client (solibo.mcp/read by default; solibo.mcp/write and solibo.mcp/communicate only when explicitly provisioned)

Obtaining a token 

curl -s -X POST \
  https://auth.home.solibo.no/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=<client_id>" \
  --data-urlencode "client_secret=<client_secret>" \
  --data-urlencode "scope=solibo.mcp/read"

If Solibo provisions a client without a secret, omit the client_secret field.

Calling the MCP server

MCP clients should initialize first:

curl -s -X POST https://mcp.home.solibo.no \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-03-26",
      "capabilities": {},
      "clientInfo": {
        "name": "my-service",
        "version": "1.0"
      }
    }
  }'

Then call tools on the same MCP endpoint:

curl -s -X POST https://mcp.home.solibo.no \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "get_company_snapshot",
      "arguments": {
        "companyId": 123456
      }
    }
  }'

Any MCP client or transport wrapper that can attach the bearer token can use the same endpoint. The integration target is https://mcp.home.solibo.no (or the dev endpoint), not a separate Solibo backend API.

Scopes

Scope Grants access to
solibo.mcp/read All query tools
solibo.mcp/write Confirmed mutation tools, when explicitly provisioned
solibo.mcp/communicate Customer communication tools, when explicitly provisioned

Request only the scopes your integration needs.

Backend mapping

The bearer token alone is not enough. Solibo also provisions a backend client_user mapping for the M2M client ID:

  • The client_user decides which companies and records the service can access.
  • The backend resolves identity from client_id, because M2M tokens do not carry a user sub.
  • Solibo Home backend authorization still applies on every tool call.

Session context in M2M

M2M clients can use the same session shortcuts as end users by including a consistent Mcp-Session-Id header across requests. This allows set_working_company to persist across tool calls within a logical session.

Solibo AS