Analytics MCP server: can a third-party app connect with the customer's own OAuth User credentials?

Hello,

We run allmates.ai, an enterprise AI assistant platform. Several of our customers use Adobe Analytics and Customer Journey Analytics, and would like to reach the Analytics MCP servers (https://aa-mcp.adobe.io/mcp and https://cja-mcp.adobe.io/mcp) from our product.

The dynamic client registration endpoint advertised in the authorization-server metadata only accepts an allowlist of partner redirect URIs (claude.ai, chatgpt.com, cursor.com, plus loopback addresses), so our own callback is rejected. Rather than asking to be added to that list, we would like to follow what looks like the intended path for customers: each customer creates its own OAuth application, and we use those credentials.

The setup we plan to document for our customers:

1. An Adobe administrator adds the MCP Access permission item to the relevant product profile, and adds the developer on the Developers tab.

2. That developer creates a Developer Console project, adds the Adobe Analytics (or CJA) API, and creates an OAuth User authentication credential on the Web App platform.

3. They declare our redirect URI in that credential, and give us the client ID and the client secret.

4. Our platform runs the authorization code + PKCE flow against ims-na1.adobelogin.com, requesting openid, AdobeID and additional_info.projectedProductContext, and each of their users signs in with their own Adobe ID.

Questions:

1. Is this a supported way to reach the MCP servers, i.e. does the MCP server accept an IMS user token issued to a client credential it did not register itself?

2. With a user token, are the x-api-key and x-gw-ims-org-id headers expected, as they are in the documented server-to-server flow? Is x-global-company-id required for Adobe Analytics, or is setSessionDefaults the intended way to select the company?

3. User authentication credentials start In Development, where only listed beta users can sign in, and the documentation states that an application can serve Adobe users with a company or school account only after an Adobe review. Does a customer need that review to let its own employees sign in to its own application? This is the point that decides whether each customer can set this up on its own.

4. Are any scopes needed beyond the three above?

The same question is open on GitHub, on AdobeDocs/analytics-2.0-apis (issue 721) and AdobeDocs/analytics-mcp (issue 12).

Thank you,

Romain Chaumais, allmates.ai