Analytics MCP server — client registration for a third-party MCP client

Hello,

We operate [allmates.ai](https://allmates.ai), an enterprise AI assistant platform. Several of our customers run Adobe Analytics and Customer Journey Analytics, and we would like to expose your MCP servers (`https://aa-mcp.adobe.io/mcp` and `https://cja-mcp.adobe.io/mcp`) to them.

Our platform is a remote MCP client: it discovers the protected-resource metadata, then registers through the `/register` endpoint advertised in your authorization-server metadata. That call succeeds for `claude.ai`, `chatgpt.com` and `cursor.com` redirect URIs, and for loopback URIs, but is rejected with `invalid_redirect_uri` for ours, which indicates an allowlist of partner client domains.

Two questions:

**1. Can our callback be added to that allowlist?** Our customers are served on per-tenant hosts, so the entry would need to cover `https://*.allmates.ai/oauth/callback`. If there is a qualification process for MCP clients, we are happy to go through it — please point us to it.

**2. Failing that, is a customer-created Adobe application a supported path?** Concretely: a customer creates an OAuth User authentication credential (Web App) in their own Adobe Developer Console project, adds the Analytics or CJA API, declares our redirect URI, and our platform runs the authorization-code flow with that client id and secret, requesting the `openid AdobeID additional_info.projectedProductContext` scopes.

- Does the MCP server accept an IMS user token issued to a client it did not register itself?
- Are the `x-api-key` and `x-gw-ims-org-id` headers expected in that case, as they are in the server-to-server flow? Is `x-global-company-id` needed for Analytics?
- Does such an application need to be promoted out of development mode — and therefore to pass an Adobe review — before the customer's own enterprise users can sign in to it?

Answering question 2 alone would already unblock our customers, since it requires nothing from Adobe beyond a documented answer.

Thank you,
Romain Chaumais — allmates.ai

Start by reviewing the protected-resource metadata, the authorization-server metadata, and the advertised /register endpoint for the Analytics and CJA MCP servers. Trace the redirect-URI and OAuth questions raised in the issue, then document whether customer-created Adobe applications and their tokens are supported, including the required headers, scopes, and development-mode requirements.

Written by the indexing model from the issue text.