Skip to main content
Glama
YosefHayim

ebay-mcp

by YosefHayim
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

ebay_exchange_authorization_code

Exchange an eBay OAuth authorization code for access and refresh tokens to complete the authorization flow, store credentials automatically, and enable authenticated API calls.

Instructions

Exchange an OAuth authorization code for access and refresh tokens. This completes the OAuth 2.0 Authorization Code grant flow. After the user authorizes the application using the URL from ebay_get_oauth_url, eBay redirects back with an authorization code in the URL. Use this tool to exchange that code for tokens that can be used to make API calls. The tokens will be automatically stored and used for subsequent API requests.

IMPORTANT NOTES:

  • Authorization codes expire in ~5 minutes - if you get "invalid grant" error, get a fresh code

  • Codes can be URL-encoded (e.g., v%5E1.1%23...) - this tool automatically decodes them

  • Extract the code parameter from the redirect URL (your RuName Accept URL): https://your-redirect-uri?code=YOUR_CODE&expires_in=299

  • Tokens are saved to .env file and will auto-refresh every 2 hours

  • Refresh tokens last 18 months before requiring re-authorization

COMMON ERRORS:

  • "invalid or was issued to another client": Code expired, get fresh code

  • "Insufficient permissions": Re-run OAuth flow with additional scopes in ebay_get_oauth_url

For scopes and rate limits, see the "Authentication & rate limits" section of the ebay-mcp README.

Input Schema

NameRequiredDescriptionDefault
codeYesThe authorization code received from eBay after user authorization

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.14.1
    • changedInput schema / properties / code / description
      Previous value: -"The authorization code received from eBay after user authorization. This is the \"code\" parameter in the redirect URL."New value: +"The authorization code received from eBay after user authorization"
  2. First observedv1.8.10

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so well. It discloses that tokens are stored automatically, saved to .env, auto-refresh every 2 hours, refresh tokens last 18 months, authorization codes expire in ~5 minutes, and URL-encoded codes are automatically decoded.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence states the core action and outcome. The following notes are organized into important caveats and common errors with no filler; every bullet provides actionable operational context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an OAuth code-exchange tool with no output schema, the description is complete enough to invoke correctly. It covers prerequisites, input extraction, token storage, refresh behavior, expiry, and common failure modes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema fully documents the single code parameter, the description adds valuable meaning: where to extract the code from the redirect URL, an example URL format, the URL-encoding behavior, and the short code lifetime.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: exchange an OAuth authorization code for access and refresh tokens. It clearly ties this to completing the OAuth 2.0 Authorization Code grant flow and distinguishes the tool from siblings like ebay_get_oauth_url and ebay_refresh_access_token.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use this tool: after the user authorizes via the URL from ebay_get_oauth_url and eBay redirects with a code. It also gives concrete recovery guidance, such as getting a fresh code after an invalid grant and re-running the flow for insufficient permissions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools