Skip to main content
An Agent Platform can use Clink as the account and payment data source behind its own portal. The platform backend authenticates as itself, obtains a read-only token for one user, and calls Clink REST APIs to render that user’s data. The portal API never performs a write. It does not create orders, issue refunds, change payment methods, or modify purchase authorizations.

​
How it works

The platform client is the same pre-registered client used by Agent Platform MCP Login. The portal token is a separate user token and is valid only for the portal read APIs.

​
What you can build

​
Token types

The portal user token cannot call /mcp, and the MCP token cannot call /agent/platform/**. Keep the platform token on the server; do not send it to the platform’s browser or to an Agent.

​
Data scope

The portal token’s sub is the Clink customer_id. Clink resolves the user only from that verified token; there is no request parameter for choosing a different customer_id or email. Portal data is scoped to the user, not to an Agent:
  • Orders, refunds, and authorizations include data created by any Agent for that user.
  • The response does not filter by agent_client_id or agentInfo.clientId.
  • A customer cannot read another customer’s records; single-record endpoints return 404 when the record is not owned by the token’s user.
  • Order filtering uses a bounded scan. The order list response includes truncated when the scan limit was reached.

​
Prerequisites

Clink must pre-register the platform client in the target environment with:
  • A platform client_id and client_secret.
  • The exact OAuth redirect_uri used for first-time user authorization.
  • The environment MCP resource and the MCP scopes.
  • The portal audience and portal:read scope.
The platform must verify the user’s email before requesting a token. The platform client cannot be created through Dynamic Client Registration.

​
Environment endpoints

​
API surface

Portal token

Exchange the platform client token for a read-only token for one user.

Read APIs

Account, payment methods, orders, refunds, and authorizations.