Authentication

Every /rest/v1/* operation and MCP request requires a Bearer token. The broker validates Authorization: Bearer <key> against the MLOOP_INTERNAL_MCP_API_KEY environment variable on the server.

Getting a key

The broker key is the same credential used by the v1 internal MCP server. In local development, provide it through Doppler:

doppler run -p mloop-internal -c development -- pnpm dev

Store the key securely. It grants access to every upstream service configured in the broker.

Making authenticated requests

curl -s \
  -H "Authorization: Bearer $MLOOP_INTERNAL_MCP_API_KEY" \
  "https://api.modernloop.dev/rest/v1/github/repos/ModernLoop/mloop-internal/pulls?perPage=5"

const response = await fetch(
  'https://api.modernloop.dev/rest/v1/github/repos/ModernLoop/mloop-internal/pulls?perPage=5',
  {
    headers: {
      Authorization: `Bearer ${process.env.MLOOP_INTERNAL_MCP_API_KEY}`,
    },
  }
);

const data = await response.json();

Unauthenticated routes

These endpoints are intentionally public:

Errors

Invalid or missing credentials return HTTP 401 with the standard error envelope:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or invalid bearer token"
  }
}

OAuth (planned)

OAuth for user-delegated access is on the roadmap. Until then, use the shared broker API key for all automation and internal tooling.

See the MCP connection guide for the production Streamable HTTP endpoint and client settings.