How to set up the Intercom MCP server

Intercom manages customer conversations, support operations, and user data. Choose OAuth to sign in as an Intercom user, or bearer-token authentication for a dedicated, non-interactive automation identity. Intercom's MCP guide is the source of truth for both methods and its current permission requirements.

This guide prepares Intercom for an MCP client. The Intercom agent template deploys the Dome configuration separately.

Choose a connection method

Choose OAuth when the MCP connection should act as an Intercom user and may need Fin Operator tools. Choose bearer-token authentication for a shared non-interactive connection that should bypass the browser, callback, and allowlist flow. Intercom's MCP guide documents both methods.

Recommended: OAuth

Use OAuth when the MCP connection should act as an Intercom user. Create a test workspace or test data, then sign in as a member whose role has only the conversations, contacts, companies, and articles the MCP server needs.

1. Ask Intercom Support to allowlist the MCP client's exact callback URL. For Dome, request https://api.domesystems.ai/oauth/callback; Intercom allows localhost callbacks automatically but rejects non-localhost callbacks until they are approved.
2. Use https://mcp.intercom.com/mcp for US-hosted workspaces or https://mcp.eu.intercom.com/mcp for EU-hosted workspaces.
3. Select OAuth in the MCP client and start the connection. Intercom dynamically registers compatible clients, so do not create or paste a separate OAuth client secret for this flow.
4. Sign in to the intended Intercom workspace as the test member and approve the consent screen. Check the callback address before allowing access.
5. Retrieve a known test conversation and verify that restricted or unrelated data is unavailable.

OAuth is the only method that can expose Fin Operator tools. See Intercom's MCP authentication guidance for the current consent, callback, and allowlist behavior.

Alternative: Bearer token

Use bearer-token authentication for a non-interactive, workspace-owned connection. It does not open a browser, require a callback URL, or need Intercom's redirect-URI allowlist. Create a restricted Intercom workspace access token, store it in the MCP client's secret store, and send it with every request as Authorization: Bearer <INTERCOM_ACCESS_TOKEN>.

1. In Intercom Developer Hub → Your Apps, open the private app that matches the workspace name. A migrated workspace may call it Access Token App.
2. Open Authentication to reveal the workspace access token and review its scopes. Intercom's workspace access-token walkthrough shows the same path.
3. Select API key / Token (or the equivalent bearer-token option) in the MCP client rather than OAuth.
4. Add the US or EU MCP endpoint and configure the authorization header as Bearer <INTERCOM_ACCESS_TOKEN>.
5. Grant only the required Intercom permissions. Start with read access; add conversation or article write permissions only when the MCP workflow needs those actions.
6. Record the token's owner and rotation date, then test an allowed record and a denied boundary.

Bearer-token connections do not receive Fin Operator tools. For the current endpoint, permissions, and client examples, see Intercom's MCP bearer-token configuration.

Verify Intercom MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that Intercom MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved Intercom boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

If registration or authorization reports an invalid or unallowed redirect URI, the callback has not been allowlisted—ask Intercom Support to approve the exact URI before retrying. Switch to bearer-token authentication when browser sign-in or callback allowlisting is not suitable for the integration. An authorization that succeeds against the wrong workspace should be revoked and repeated with the correct test account. Missing conversations generally reflect team inbox access or role permissions, not a failed MCP server.

Next steps

Deploy the Intercom agent template to create a governed agent in Dome that can work with the approved customer conversations and data, with the template's included model, tools, and rules.