Authentication with an agent

An agent connects to the Core MCP at https://api.requestrocket.com/mcp. It can authenticate in two ways. Use OAuth when a person is present to sign in. Use a user token when the agent runs on its own.

Sign in with OAuth

Add https://api.requestrocket.com/mcp to your agent client as a remote MCP server, without a token. The server publishes its sign-in details at https://api.requestrocket.com/.well-known/oauth-protected-resource. A client that supports MCP OAuth discovers them there, opens the hosted login in your browser, and signs you in. The client then sends the issued bearer token on each call.

A token issued this way works on the Core MCP only. It does not authenticate Core API calls.

Use a user token

Send a token from API keys as the Authorization header. The value is the token itself. Do not add Bearer. A Bearer value is treated as an OAuth token and a user token fails there.

Many clients read remote servers from a JSON file in this shape:

{
  "mcpServers": {
    "requestrocket": {
      "url": "https://api.requestrocket.com/mcp",
      "headers": {
        "Authorization": "u-your-token"
      }
    }
  }
}

The agent acts as the user who owns the token. It can reach the same organisations and resources that user can.

Check the connection

Ask the agent to call list_clients. A successful call returns your organisations, which confirms the credential works.

Tools

• list_clients — Lists the organisations the connected user belongs to. A quick check that authentication works.

Next