Authentication

​

API Management Endpoints

Authorization: Bearer YOUR_API_KEY  # Required
x-alloy-userid: YOUR_USER_ID        # Optional when using API key

x-alloy-user-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

​

MCP Protocol Endpoints

https://mcp.runalloy.com/mcp/{serverId}/{accessToken}

https://mcp.runalloy.com/mcp/{serverId}
Authorization: Bearer YOUR_API_KEY
x-alloy-userid: YOUR_USER_ID

​

JWT User Isolation

• When using x-alloy-user-token header with a JWT
• The server extracts the userId from the JWT payload
• Each JWT user gets isolated data based on their JWT userId

curl -X POST https://mcp.runalloy.com/mcp/{serverId}/{token} \
  -H "x-alloy-user-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc": "2.0", "method": "tools/call", "params": {...}, "id": 1}'

​

Security Best Practices

1. Never share your API key or token URL - Treat them like passwords
2. Rotate keys regularly - Generate new keys periodically
3. Use restrictions - Limit what each server can access
4. Monitor usage - Check logs for unexpected activity
5. Store credentials securely - Use environment variables or secret managers