MCP server

digid pay exposes a Model Context Protocol (MCP) server so AI agents can manage payments on a merchant's behalf — always through a human approval gate for money movement. An agent can create an intent, but a charge never reaches the acquirer without an explicit human approval.

Status. The MCP surface is contract (routes inside the facade, day-one per FR-14 / AD-12). The examples below are the integration contract.

Endpoint

https://api.digid.cc/mcp

Authenticate as the merchant whose keys the agent holds. Agent surfaces use the merchant's scoped secret key (or a scoped key labelled for agent use); per-merchant agent limits (max amount, daily cap) are enforced before an approval is even requested.

Tool catalog

Tool	Action	Approval gate
payment_intent.create	Create a PaymentIntent	starts requires_approval for agent flows
payment_intent.retrieve	Read status	none (read)
payment_intent.list	List intents	none (read)
payment_intent.approve	Approve an agent intent	approver-scoped
payment_intent.cancel	Cancel a non-terminal intent	none
refund.create	Refund a succeeded intent	none (reflects your normal controls)
refund.retrieve	Read refund	none
webhook_endpoint.list	List endpoints	none
key.list	List key metadata	none

payment_intent.create from an agent returns an intent in requires_approval:

{
  "id": "pi_1Ab...",
  "status": "requires_approval",
  "livemode": true,
  "approval": { "required": true, "state": "pending" }
}

The intent does not proceed until a designated human approver calls payment_intent.approve (dashboard or API). A decline = cancel. Every approval is recorded (approver identity + timestamp).

Client configuration

Claude Desktop / any MCP client

{
  "mcpServers": {
    "digid-pay": {
      "type": "http",
      "url": "https://api.digid.cc/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_..."
      }
    }
  }
}

Generic MCP over SSE/HTTP

Point any MCP client at https://api.digid.cc/mcp with the Bearer header above. The server advertises its tools via the standard tools/list handshake; no custom wiring is required.

Python (MCP SDK)

from mcp import ClientSession, StdioServerParameters  # stdio not used here
import httpx, json

# HTTP transport against the digid pay MCP endpoint:
#   url: https://api.digid.cc/mcp
#   headers: { "Authorization": "Bearer sk_live_..." }

For a ready-to-run client, use the official MCP client of your runtime and point it at the endpoint with the header. digid pay publishes typed client examples alongside the contract as codegen lands (planned).

TypeScript

// Generic MCP client (any SDK), endpoint https://api.digid.cc/mcp
const transport = new StreamableHTTPClientTransport(
  new URL('https://api.digid.cc/mcp'),
  { headers: { Authorization: `Bearer ${process.env.DIGIDPAY_SECRET_KEY}` } },
)
const client = new Client({ name: 'my-agent', version: '1.0.0' })
await client.connect(transport)
const tools = await client.listTools()

Approval semantics (agents)

1. Agent calls payment_intent.create → intent is requires_approval.
2. Merchant's designated approver is notified (dashboard).
3. Approver approves (or declines/cancels).
4. Only then does the charge proceed to the acquirer (SCA applies per the acquirer, unchanged).
5. The full lifecycle is audit-trailed and distinguishable in reports as agent-initiated.

Opt-in per merchant

Agent-initiated payments are opt-in per merchant. Until a merchant enables the agent surface and configures approvers and limits, agent tools return insufficient_permissions.

Further reading

• A2A AgentCard — agent-to-agent discovery and task flow.
• Payments — the REST equivalents.