From 08029c8044f7a5eb1a130030b90e6f7cd78afc50 Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Sat, 5 Sep 2026 18:50:42 +0000 Subject: [PATCH] docs(readme): document opax-mcp auth --- README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/README.md b/README.md index d41b3f8..456bd09 100644 --- a/README.md +++ b/README.md @@ -68,3 +68,17 @@ gcloud scheduler jobs create http daily-billing-snapshot \ --description="Kaller /billing/snapshot for å lagre daglig kostnadsdata." ``` Denne kommandoen oppretter en jobb som kjører hver dag kl. 05:00 UTC. + +## OPAX MCP connector authentication + +The public Cloud Run service permits network invocation so that third-party MCP clients can reach the application. Authentication is enforced by the application. + +The server accepts a credential supplied in one of these request headers: + +- `api-key` +- `X-MCP-Secret` +- `Authorization: Bearer ` + +For every supported header form, the extracted credential must exactly match the `MCPSECRET` value injected from Google Secret Manager (`mcp-server-key`). The service rejects missing or non-matching credentials with HTTP 401. + +Do not commit, log, or document the secret value itself.