Skip to main content
Glama
Sign In
Payware MCP Server

Payware MCP Server

Official
by payware
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

payware_authentication_create_jwt_token

Read-onlyIdempotent

Create a JWT token for Payware API authentication, signing with sandbox or production keys and optionally hashing a request body for POST, PUT, or PATCH calls.

Instructions

[Merchant] Create JWT token for payware API authentication according to official documentation

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "payware_authentication_create_jwt_token"
  }
}

Input Schema

NameRequiredDescriptionDefault
partnerIdNoPartner ID from payware dashboard. Uses PAYWARE_PARTNER_ID env var as default.
privateKeyNoRSA private key - accepts PEM format with/without headers or raw base64 content. Uses environment-specific private key as default.
useSandboxNoSign with the sandbox key (default) or the production key; a token signed with one environment's key is refused by the other
requestBodyNoRequest body for a POST, PUT or PATCH, which then needs contentSha256. An object is serialized once (keys sorted, no spaces) and the result shows that exact string: send it byte for byte. A string is hashed as given.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.2.0

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive, and closed-world, so the safety profile is covered. The description adds no behavioral context beyond that — nothing about token lifetime/expiry, what happens if the wrong environment key is used, or auth requirements. Note the useful sandbox-vs-production key behavior appears only in the schema, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence that is front-loaded with the verb and resource, which is good. However, the trailing clause 'according to official documentation' is filler that does not help the agent and crowds out information that would have earned its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter authentication tool with no output schema and related setup siblings (generate_rsa_keys, setup_sandbox_auth), the description omits prerequisites, how the returned token is consumed, and environment selection. An agent could invoke it, but not confidently without reading the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including env-var defaults for partnerId and privateKey and the byte-exact requestBody hashing rule, so the schema carries parameter meaning fully. The description adds nothing about parameters, which meets the baseline-3 expectation when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Create JWT token') plus the domain ('payware API authentication'), so an agent knows broadly what the call produces. It does not distinguish this tool from siblings such as test_jwt, validate_jwt, or setup_sandbox_auth, leaving the boundary to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance: no mention of when a token is needed versus validating or testing one, and no stated prerequisites such as generating RSA keys or running sandbox setup first. The phrase 'according to official documentation' is a pointer, not guidance, and leaves the agent without actionable selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools