Authentication
Web sessions for the app; personal access tokens for API and MCP.
Web sessions for the app; personal access tokens for API and MCP.
Web
Cookie sessions with CSRF protection for the dashboard and marketplace actions.
API tokens
Sanctum personal tokens for automation. Store tokens like secrets; rotate when compromised.
MCP
The MCP HTTP endpoint requires an authenticated user/token. It is not a public anonymous API.