Authentication

Every request to the Precursor Intelligence MCP server must include a bearer token. The same API key works for both the MCP server and the REST API.

Header

Authorization: Bearer <YOUR_API_KEY>

The header name is Authorization (capital A). The scheme must be Bearer followed by exactly one space and your key. Any other format is rejected.

Invalid or missing credentials return a single response: -32001 unauthorized, HTTP 401.

Creating and managing keys

Keys are created from the dashboard at precursorintelligence.com under Settings → API Keys. The full secret is shown once at creation and cannot be retrieved later. If you lose a key, revoke it and generate a new one. You can also set an optional expiry date when creating a key, after which it stops working automatically.

Keys are organisation-owned. All members of an organisation share one credit pool across both the MCP server and the REST API.

IP allowlists

You can restrict a key to specific source IPs from the dashboard. If an IP allowlist is set and the request originates from an address not on the list, the server returns -32001 unauthorized. This is intentional: the response does not distinguish between an unknown key and an IP restriction, to avoid leaking which keys exist.

Sessions

The server is stateless. There is no session ID, no login flow, and no cookie. Every request is verified independently. You can send requests concurrently from any number of workers without coordination. The only shared state is your organisation's credit balance.

The MCP spec's mcp-session-id header is accepted in CORS preflights for compatibility but is ignored on actual requests.

CORS

The endpoint does not set Access-Control-Allow-Origin. Browsers will block direct cross-origin requests. The server is intended for server-to-server, CLI, or desktop-app use. If you need browser access, proxy requests through your own backend.

Auth errors

All authentication failures map to JSON-RPC -32001 unauthorized / HTTP 401, regardless of root cause. The error response does not enumerate the specific reason.

Key rotation

Treat keys as long-lived but rotatable. To rotate:

1. Generate a new key from the dashboard.
2. Roll out the new key to all clients (desktop app config, CI environment variables, etc.).
3. Once traffic has shifted, revoke the old key from the dashboard.

Revoked keys are rejected within seconds. There is no caching delay.