diff --git a/main.py b/main.py
index f74e315..8f185fe 100644
--- a/main.py
+++ b/main.py
@@ -190,7 +190,12 @@ def require_auth(func):
         if user:
             return await func(request, *args, **kwargs)
         
-        # 2. Bearer token (Cloud Run identity token)
+        # 2. Internal API key (maskin-til-maskin, opax-mcp → osvauco-agent)
+        internal_key = request.headers.get('X-Internal-Key', '')
+        if internal_key and internal_key == os.environ.get('INTERNAL_API_KEY', ''):
+            return await func(request, *args, **kwargs)
+
+        # 3. Bearer token (Cloud Run identity token)
         auth_header = request.headers.get('Authorization', '')
         if auth_header.startswith('Bearer '):
             token = auth_header[7:]
diff --git a/opax-mcp/server.py b/opax-mcp/server.py
index 3a65dd5..ed277e5 100644
--- a/opax-mcp/server.py
+++ b/opax-mcp/server.py
@@ -116,7 +116,7 @@ def _osvauco_agent_identity_token() -> str:
         raise
 
 def _osvauco_agent_headers() -> dict:
-    return {"Authorization": f"Bearer {_osvauco_agent_identity_token()}", "X-MCP-Secret": os.environ.get("MCP_SECRET", ""), "Content-Type": "application/json"}
+    return {"Authorization": f"Bearer {_osvauco_agent_identity_token()}", "X-Internal-Key": os.environ.get("INTERNAL_API_KEY", ""), "Content-Type": "application/json"}
 
 async def _osvauco_agent_post(path: str, body: dict) -> Any:
     """Kaller osvauco-agent direkte med service-to-service auth."""