Portal
SandboxAPI v1Not signed inExternal user: —

MCP authentication

Two models: trusted API-key integrations and interactive OAuth clients.

Models

  • API key — trusted servers; X-API-Key + optional X-External-User-ID
  • OAuth — Cursor, Claude, Codex, etc.; application-scoped MCP URL + bearer token

Application-scoped endpoint

https://mcp.foodapi.dev/apps/{public_id}/mcp

No developer API key is required in end-user MCP client configuration. Applications.

OAuth flow

  • Authorization Code + PKCE (S256)
  • Public clients (token_endpoint_auth_method: none)
  • Dynamic client registration where supported
  • Short-lived access tokens + refresh tokens

See also

User identity · External OIDC · REST authentication