MCP

The Stax Docs Model Context Protocol (MCP) server lets AI-powered editors like Cursor and Windsurf — plus general-purpose assistants like Claude — search the Stax documentation and execute real Stax API endpoints on your behalf.

Searching the docs works out of the box with no setup. Executing endpoints requires you to add your own Merchant or Partner API key to your MCP client's configuration, which is what most of this page covers.

What is MCP?

Model Context Protocol (MCP) is an open standard that allows AI applications to securely access external data sources and tools. The Stax Docs MCP server gives your AI assistant these tools:

ToolWhat it doesNeeds your API key?
searchSearches the Stax documentationNo
fetchRetrieves the full content of a documentation pageNo
list-endpointsLists every Stax API path and methodNo
search-endpointsSearches paths, operations, and parametersNo
get-endpointReturns full detail for one endpoint, including its security schemeNo
execute-requestCalls a live Stax API endpointYes

Quick Start (Docs Only)

Stax hosts a remote MCP server at https://docs.staxpayments.com/mcp. The server is public, so this configuration alone gives your assistant full access to search and read the documentation.

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "staxapi": {
      "url": "https://docs.staxpayments.com/mcp"
    }
  }
}

If you try to run an endpoint before adding a key, the execute-request tool refuses the call and returns a Missing Security Schemes error naming the key type that endpoint requires.


Executing Endpoints With Your API Key

Any header you set on the MCP server in your client configuration is forwarded by execute-request to the Stax API on every request. Adding an Authorization header is therefore all it takes to let your assistant enroll merchants, create customers, run transactions, and pull reports directly from your editor.

Step 1: Choose the Right Key

Stax endpoints are secured by one of two key types. Which one you need depends entirely on which endpoints you intend to run.

Merchant API Key

Covers the large majority of the API — customers, payment methods, transactions, invoices, terminals, and reporting.

Scoped to a single merchant account. Cannot reach partner-level endpoints.

Partner API Key

Covers enrollment and portfolio management — /admin/enroll, /merchant, and merchant API key management.

Also grants access to merchant-level operations for accounts under your management.

📘

Not sure which a given endpoint needs? Ask your assistant to run get-endpoint on it. The response includes the endpoint's security block, which names either ApiKeyAuth (merchant) or PartnerApiKey (partner).

Step 2: Get Your Key

  1. Log in to Stax Pay.
  2. Select the account you want the key scoped to from the merchant switcher in the upper-right corner.
  3. Go to AppsAPI KeysLaunch.
  4. Click New Key, name it, assign a role, and click Save.
  5. Click the key icon next to the new key to view and copy it.

Full instructions: Merchant API Keys

❗️

Sandbox and production use the same base URL. Every request goes to https://apiprod.fattlabs.com regardless of environment — the key you paste is the only thing that determines whether your assistant is moving test money or real money. Use a sandbox key while you are experimenting.

Step 3: Add the Key to Your Configuration

Add a headers object to your server entry and set Authorization to Bearer followed by your key.

~/.cursor/mcp.json:

{
  "mcpServers": {
    "staxapi": {
      "url": "https://docs.staxpayments.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Restart your editor or assistant after saving so it reconnects with the new header.

🚧

Your API key is stored in plain text in these configuration files. Keep them out of version control, and prefer a sandbox key or a key with a narrowly scoped role for day-to-day development.

Step 4: Register Both Keys as a Partner

Each MCP server entry forwards exactly one Authorization header. Because partner developers need the Partner API for enrollment and the Merchant API for everything else, register the server twice under different names — one entry per key.

{
  "mcpServers": {
    "stax-partner": {
      "url": "https://docs.staxpayments.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_PARTNER_API_KEY"
      }
    },
    "stax-merchant": {
      "url": "https://docs.staxpayments.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MERCHANT_API_KEY"
      }
    }
  }
}

Your assistant then picks the entry that matches the endpoint. Name the entries clearly — stax-partner and stax-merchant are far easier for an assistant to route correctly than staxapi and staxapi2.

📘

To switch between sub-merchants, retrieve the merchant's key with the List API Keys for Merchant endpoint using your partner entry, then update the stax-merchant entry with that key. See Merchant API Keys for guidance on storing merchant keys systematically.

Step 5: Verify Your Setup

Start a new chat in your AI tool and confirm each layer works:

  1. Docs search — "What ACH error codes does Stax return?"
  2. Endpoint lookup — "Use get-endpoint to show me the fields required to create a customer."
  3. Live execution — "List the customers on my account." A successful call returns real data from your account. A Missing Security Schemes error means the header is not reaching the server.

Once execution is working, you can ask your assistant to chain steps end to end — for example, "Enroll a test merchant, create a customer on it, tokenize a card, and run a $1.00 sale."

Troubleshooting

Missing Security Schemes

execute-request did not receive an Authorization header. Confirm you added the headers object to the correct server entry, that the value begins with Bearer (including the space), and that you fully restarted your editor. The error message names the scheme the endpoint expects: ApiKeyAuth is a merchant key, PartnerApiKey is a partner key.

token_invalid: Could not decode token

The header reached the Stax API, but the value is not a valid key — usually a truncated copy/paste, a stray quote, or the word Bearer duplicated. Copy the key again from the API Keys app.

401 Unauthorized on partner endpoints

You are sending a merchant key to a partner endpoint. Merchant keys cannot reach /admin/enroll, /merchant, or merchant key management routes. Add a second server entry with your partner key as shown in Step 4.

429 Too Many Requests

The Stax API allows 100 requests per minute. An assistant working through a long task can hit this. The Retry-After header tells you when to resume. See the rate limit details in the API Overview.

My client does not support custom headers

Some MCP clients — including the Claude web UI — cannot send custom headers on a remote server. Documentation search and endpoint lookup still work, but execute-request cannot authenticate. Use a desktop client or a coding agent that supports a headers object for live execution.

Next Steps


Did this page help you?