# MCP Allowlist Request - town.com

**URL:** <https://developer.squareup.com/forums/t/mcp-allowlist-request-town-com/26364>\
**Category:** MCP\
**Created:** [June 8, 2026, 6:44pm UTC](https://developer.squareup.com/forums/t/mcp-allowlist-request-town-com/26364 "2026-06-08T18:44:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dariatsenter](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dariatsenter](https://developer.squareup.com/forums/u/dariatsenter)\
**Post date:** [June 8, 2026, 6:44pm UTC](https://developer.squareup.com/forums/t/mcp-allowlist-request-town-com/26364/1 "2026-06-08T18:44:00Z")

</div>

Hi Square Dev Team!

Writing from the engineering team at Town - an email first AI assistant. Multiple users have requested an ability to connect their Square accounts and access Square tools through your MCP server.

**DCR allowlist request:** Our dynamic client registration attempts return `400 invalid_redirect_uri — domain not in allowlist`. Please allowlist our OAuth callback:

- **Redirect URI (exact): `https://www.town.com/api/mcp/oauth/callback`**

- **Domain: `town.com`**

- **Client name: Town**

We’ve verified **`https://mcp.squareup.com/.well-known/oauth-authorization-server`** returns 200 and surfaces a `/register` endpoint, so we believe the 400 is purely the allowlist gate.

**Bonus / alternative:** We also support **CIMD (Client ID Metadata Documents)** per the current MCP spec — we publish a stable client identity at **`https://www.town.com/.well-known/oauth-client-id`**. If your MCP server advertises `client_id_metadata_document_supported`, we can connect without any per-domain DCR allowlisting. Happy to test against that if it’s available or on your roadmap.

Happy to provide any additional info. Thanks!

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [June 11, 2026, 7:26pm UTC](https://developer.squareup.com/forums/t/mcp-allowlist-request-town-com/26364/3 "2026-06-11T19:26:56Z")

</div>

This is in progress! Will report back once complete.

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [June 12, 2026, 7:26pm UTC](https://developer.squareup.com/forums/t/mcp-allowlist-request-town-com/26364/4 "2026-06-12T19:26:46Z")

</div>

This has been completed.