MCP Server Authorization Headers

How a generated MCP server handles JSON-RPC, Authorization and X-Api-Key headers.

This page clarifies exactly how a generated MCP server (see Generate from OpenAPI) handles requests and credentials.

This is the MCP server's own authorization model, for when it is called directly (see Connect with agent) or by your Tuix agent. It is a different layer from authenticating a call to Tuix AI Agents' own chat endpoint, see Application endpoints.

The server follows the JSON-RPC 2.0 protocol, as required by the MCP spec, over a Streamable HTTP transport.
If an endpoint's OpenAPI operation had a security requirement (see Generate from OpenAPI), the corresponding tool requires an Authorization header. A call missing it is rejected with an error before your API is ever called. When present, the header is forwarded to your API unchanged.
The server also accepts a static X-Api-Key header, for endpoints protected by a fixed key rather than a per-user token. When present, it is forwarded to your API unchanged, independently of Authorization.
The server does not validate whether the Authorization or X-Api-Key value it receives is actually correct, it only checks that a required header is present, and then forwards it. Rejecting an invalid or expired credential is your API's own responsibility, exactly as if it had been called directly.

Because credentials are forwarded, not verified, an MCP server is only as protected as your API's own validation of the header it receives. Do not rely on the MCP server itself as an authorization boundary.