The Rad TV API uses a multi-layered authentication system. Almost all operations require a valid Bearer token.
Summary
| Mechanism | Use case |
|---|---|
| JWT | User sessions (e.g. from Rad web/mobile login). |
| API key | Programmatic and MCP access; generated from a JWT |
| DID | Canonical public identifier for channels and content (e.g. did:rad.live:channel/<uuid>). |
Bearer token
Send the token on every request:
Authorization: Bearer <jwt-or-api-key>
- GraphQL — Include this header on
POST /graphql. Queries and mutations marked with@authrequire it. - MCP — Required for
POST /mcp(initialize, list tools, call tools). - Ingestion —
POST /ingestion/:idrequires an API key (Bearer).
Without a valid Bearer token, protected operations return 401.
Public operations (no auth)
Only these do not require authentication:
ratings(limit, start)— Content ratings (e.g. MPAA, TV).genres(limit, start)— Content genres.
All other GraphQL operations and MCP tool calls require Bearer auth.
