Stripe MCP Server

Aembit supports the official Stripe MCP server, which lets AI agentsAI Agent: A software workload that authenticates to systems, requests credentials, and accesses resources, either on behalf of a person or on its own. Aembit secures AI agents with the same identity-first model it uses for any workload. User-driven agents such as Claude Desktop also carry a blended identity that ties access to both the user and the agent.Learn more query payments, billing, and account data through MCPModel Context Protocol: A standard protocol for AI agent and server interactions that defines how AI assistants communicate with external tools and data sources.Learn more(opens in new tab) tools.

This page describes how to configure Stripe as an MCP serverMCP Server: A server that implements the Model Context Protocol to provide tools, resources, or data to AI agents and MCP clients.Learn more(opens in new tab) behind the Aembit MCP Identity GatewayMCP Identity Gateway: A component that brokers MCP traffic between MCP clients and target MCP servers, validating authorization and presenting Aembit-managed credentials on each request.Learn more. Each user authenticates with their own Stripe identity, and the Gateway injects their token into MCP requests.

This guide builds the Gateway-to-Server PolicyGateway-to-Server Policy: The Access Policy that authorizes the MCP Identity Gateway to access an MCP server on behalf of authenticated users—the Gateway itself is the Client Workload. Also called right-side auth; each MCP server behind the Gateway needs its own.Learn more—the second of the two Access PoliciesAccess Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more the MCP Identity Gateway requires. You create the first, the Client-to-Gateway PolicyClient-to-Gateway Policy: The Access Policy that validates which MCP client can connect to the MCP Identity Gateway and authenticates users through your Identity Provider. Also called left-side auth; you create one per MCP client and Gateway combination.Learn more, during Gateway setup.

Prerequisites

Before you begin, ensure you have the following:

• A Stripe account with MCP access enabled for the environment you plan to use
• A configured Aembit MCP Identity Gateway

Requirements and considerations

Before you configure Stripe, review these requirements and behaviors specific to Stripe’s MCP server.

• Use User-Based Auth. Aembit supports User-Based Auth for Stripe.
• An administrator enables MCP access per environment. Turn on MCP access at MCP settings. Sandbox and live mode each need their own approval, and an OAuth session covers only the environment the user authorized. Test mode works on a free account; live mode requires an activated Stripe business account.
• Stripe’s MCP tools can write. The stripe_api_write tool issues POST, PATCH, PUT, and DELETE calls, which covers actions such as issuing refunds and canceling subscriptions. Scope the Access Policy to the users who need that reach, and have the MCP client confirm tool calls with the user before running them.
• Connected accounts can’t use OAuth. A Connect platform that calls Stripe as one of its connected accounts must send a restricted API key with the Stripe-Account header, which the User-Based Auth flow doesn’t cover.

Configure the Credential Provider

Create an MCP User-Based Access Token Credential ProviderCredential Provider: Credential Providers obtain the specific access credentials—such as API keys, OAuth tokens, or temporary cloud credentials—that Client Workloads need to authenticate to Server Workloads.Learn more in Aembit.

1. Log into your Aembit Tenant.

2. Go to Credential Providers in the left sidebar and click + New.

3. Configure the following fields:

   Field	Value
   Name	A user-friendly name
   Credential Type	MCP User-Based Access Token
   MCP Server URL	https://mcp.stripe.com
   Client ID	Auto-populated—no pre-registration needed
   Client Secret	Auto-populated by Discover
   PKCE Required	On

   For MCP Server URL, click Discover to populate the Authorization URL and Token URL.

4. Click Save.

5. Copy the read-only Callback URL from the Credential Provider.

Finish configuring the OAuth client

Stripe supports OAuth Dynamic Client Registration, so you don’t need to register an app in the Stripe Dashboard.

When you create the MCP User-Based Access Token Credential Provider and click Discover, Stripe fills in the client registration automatically—Client ID, Client Secret, and URLs. Stripe grants access when each user completes the OAuth consent flow in the browser.

Authorize the Credential Provider

1. Return to the Credential Provider in Aembit and click Authorize.

2. Complete the Stripe sign-in, choose the account and environment to share, then approve access. The Credential Provider status changes to Ready when the flow completes.

Create the Server Workload

1. Go to Server Workloads in the left sidebar and click + New.

2. Configure the following fields:

   Field	Value
   Name	A user-friendly name
   Host	mcp.stripe.com
   Application Protocol	MCP
   Port	443 with TLS
   URL Path
   Authentication method	HTTP Authentication
   Authentication scheme	Bearer

3. Click Save.

Create an Access Policy

This section creates the Gateway-to-Server Access Policy, which authorizes the MCP Identity Gateway to access Stripe on behalf of authenticated users.

Create an Access Policy linking the MCP Identity Gateway (as the Client WorkloadClient Workload: Client Workloads represent software applications, scripts, or automated processes that initiate access requests to Server Workloads, operating autonomously without direct user interaction.Learn more), the Credential Provider you created, and the Server Workload for Stripe.

The Gateway is the Client Workload

In this policy, the Client Workload is the MCP Identity Gateway itself—not the AI agent or individual users. The AI agent connects through the separate Client-to-Gateway policy, and the Credential Provider enforces per-user access.

For step-by-step instructions, including the Client Workload settings that identify the Gateway, see Create the gateway-to-server Access Policy.

Verify

After a user authorizes access, the Aembit AI Access Authorized page lists the Stripe MCP Server as Ready. The AI agent can then call Stripe MCP tools through the Gateway.