AI layer (MCP)
Authentication
How the StackTracker MCP server checks your Bearer token.
The server reads a single token from the environment variable STACKTRACKER_MCP_KEY.
Every request must send this header exactly:
Authorization: Bearer <key>A wrong or missing key returns 401 Unauthorized.
This is currently one workspace token, a personal access token. It is not per-user keys. Anyone who holds it can read and write your workspace, so treat it like a password.
Keep the token secret. Rotate it by changing STACKTRACKER_MCP_KEY.
Per-user and multi-tenant key management is planned. Today it is a single shared token.