Connected apps' bearer tokens on the public API as the member's scope-narrowed session, and the MCP server at api.<host>/mcp with its protected-resource metadata (Identity ID5.2 / ID5.3)

Shipped

15 Kasım 2026 13:17 UTC

Author

Kamo

Commit

ca0be18

- Authorization: Bearer kat1_... and no session -> SecurityService resource session (cached <= 60 s by token SHA-256) -> forwarded as X-***-Token + a fresh X-OTK, never the token or a cookie; route prefix -> scope area, GET = .read, else .write; 401 invalid_token / 403 insufficient_scope with WWW-Authenticate; sessions and other bearers untouched - /mcp and **************** relayed to the MCP gateway: the client's Authorization and MCP headers, never a session, cookie or Tool Plane marker; no new host