MCP Allowlist Request - Lovable

MCP
1

Hello Square team,
I’m connecting the Square remote MCP server (mcp dot squareup dot com slash mcp) from Lovable, an AI app-building platform. OAuth client registration fails with the error “400 invalid_redirect_uri” because Lovable’s MCP client is not on the allowlist. Could you add Lovable’s MCP client to the allowlist so sellers can connect their accounts?
Thank you!

3

@ThomasB - Could you please provide the exact redirect domains to be added to the allowlist?

4

Hi jseok, thanks for the quick reply!

The redirect domain to add to the allowlist is lovable.dev.

Lovable’s OAuth infrastructure lives under lovable.dev/oauth, the authorization server metadata (lovable.dev/.well-known/oauth-authorization-server) shows:

  • Issuer: lovable.dev/oauth
  • Authorization endpoint: lovable.dev/oauth/authorize
  • Token endpoint: lovable.dev/oauth/token
  • Registration endpoint: lovable.dev/oauth/register

The OAuth callback redirect URI that Lovable registers via Dynamic Client Registration is:

lovable.dev/oauth/callback

If you can wildcard the entire lovable.dev domain (or at minimum that callback path), that covers all Lovable environments.

For context, Lovable connects to remote MCP servers (docs.lovable.dev/integrations/custom-mcp) using OAuth by default with the Streamable HTTP transport. The Square MCP server URL we’re connecting to is mcp.squareup.com/mcp.

Happy to provide any additional details. Thank you!

6

Thanks @ThomasB - I’ve submitted your information internally and will revert when your domain has been added to the allowlist.

7

@ThomasB - your domain has been added to the allowlist!