API Keys

API keys are used for programmatic access and for the MCP server (e.g. from Cursor or Claude). They are generated from a user's JWT.

Using API keys

Send it as the Bearer token:

Authorization: Bearer <api-key>

Use the same key for:

• POST /graphql — All authenticated queries and mutations
• POST /mcp — MCP initialize, tools/list, tools/call
• POST /ingestion/:id — File upload for an ingestion session

Security