Documentation MCP Authentication

MCP Authentication

The MCP server authenticates every request with a CloudCode user access token (a Supabase Auth JWT) in the Authorization: Bearer header. All tool calls, resources, and prompts run as that user through Row-Level Security (RLS) policies, so agents can only reach data that user can access.

Warning

Personal API keys (cc_live_…) are not accepted by the MCP server — they only work with the REST API (cc-api) and the Auto-Fix API. Use a user access token here.

Get an access token

For an email + password account, exchange your credentials at the Auth token endpoint (below) and use the returned access_token. Accounts that sign in only with Google, Apple, or Microsoft have no password, so use the access token of a signed-in CloudCode session.

Send it with every request

Include Authorization: Bearer <access_token> in the HTTP headers. No apikey header is needed for the MCP endpoint.

Refresh when it expires

Access tokens are short-lived (Supabase default: 1 hour) and the MCP server does not refresh them. When requests start returning 401, get a new token — e.g. with grant_type=refresh_token and the refresh_token from step 1 — and update your client config.

1. Get a token (email + password)

bash

curl -X POST 'https://tytvylihloorkrcgkzok.supabase.co/auth/v1/token?grant_type=password' \
  -H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InR5dHZ5bGlobG9vcmtyY2drem9rIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzE0NTA1NDksImV4cCI6MjA4NzAyNjU0OX0.xmz87q3PwG8D-47dvP9-KepBsutuEX4bPfmu4xvb0AM" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"<your-password>"}'
# → { "access_token": "<jwt>", "refresh_token": "...", "expires_in": ..., ... }

2. Call the MCP server

bash

curl -X POST https://tytvylihloorkrcgkzok.supabase.co/functions/v1/mcp-server \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Warning

An access token grants full access to your account until it expires. Never expose it in client-side code or public repositories; keep it in environment variables or a secrets manager.