Skip to main content

Set up the Spotify Backstage MCP server

The Spotify Backstage MCP server lets AI agents search your organization's software catalog, query internal documentation, and access data registry metadata through the MCP Actions backend. This guide covers generating a static API token in Backstage's admin settings and connecting the server to MintMCP.

Prerequisites​

  • A MintMCP admin account
  • A Spotify Backstage instance with the MCP Actions plugin (@backstage/plugin-mcp-actions-backend) enabled
  • Backstage admin access

Generate an API token​

Backstage doesn't mint the token value itself. Generate one externally and then register it.

Run this command to create a secure random token:

node -p 'require("crypto").randomBytes(24).toString("base64")'

Copy the output. You'll paste it in the next step.

Register the token in Backstage​

Backstage stores the token under External access, following Spotify's Create an API token guide.

  1. In your Backstage instance, click Admin in the left sidebar.
  2. Click App Settings.
  3. Scroll to the External access section.
  4. Click to add a new entry.
  5. Restrict plugin access to mcp-actions.
  6. Paste the token you generated into the Secret field.
  7. Click Add Item, then Save.

The token is displayed only once. If you lose it, generate a new one and update both Backstage and MintMCP.

Add Spotify Backstage to MintMCP​

Spotify Backstage is pre-listed as a recommended server in the MintMCP MCP store. Because it runs in your own infrastructure, you point the connector at your instance and authenticate it with the shared token you registered.

  1. In MintMCP, go to MCP store > Manage store.

  2. Find Spotify Backstage in the recommended servers list and open its configuration.

  3. Enter your instance's MCP endpoint URL:

    https://<your-instance>/api/mcp-actions/v1

    Replace <your-instance> with your Backstage hostname — for example, portal.example.com.

  4. Set Connection type to Shared credentials.

  5. Set Authorization method to Bearer Token.

  6. Paste the token you generated as the Bearer token value.

  7. Click Install.

Security considerations​

  • The token is an org-level shared credential — store it in a secrets manager, not in version control.
  • Restricting the External access entry to the mcp-actions plugin limits what the token can reach in your Backstage backend.
  • Rotate the token by generating a new one and updating both the Backstage External access entry and the MintMCP Bearer token value.
  • CIMD (OAuth-based authentication directly through Backstage) is in beta. Use static tokens for production deployments.

Next steps​