diff --git a/opax-mcp/server.py b/opax-mcp/server.py
index c1bbc52..783ebb9 100644
--- a/opax-mcp/server.py
+++ b/opax-mcp/server.py
@@ -1,6 +1,6 @@
 """opax-mcp — MCP tool server for OPAX/Vauco
 Transport: HTTP (FastAPI + uvicorn) for Cloud Run
-Alle tools kalles av Jason/Emma internt — ingen 3part.
+Auth: Cloud Run IAM (Authorization header) + X-MCP-Secret header for tool-level auth
 """
 import os
 import httpx
@@ -17,13 +17,13 @@ GITHUB_PAT = os.environ.get("GITHUB_PAT", "")
 GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
 
 
-def _auth_check(authorization: Optional[str]):
-    if MCP_SECRET and authorization != f"Bearer {MCP_SECRET}":
+def _auth_check(x_mcp_secret: Optional[str]):
+    if MCP_SECRET and x_mcp_secret != MCP_SECRET:
         raise HTTPException(status_code=401, detail="Unauthorized")
 
 
 # ---------------------------------------------------------------------------
-# Health
+# Health — ingen auth, Cloud Run trenger denne
 # ---------------------------------------------------------------------------
 
 @app.get("/health")
@@ -43,9 +43,9 @@ class ToolRequest(BaseModel):
 @app.post("/tools/call")
 async def call_tool(
     req: ToolRequest,
-    authorization: Optional[str] = Header(default=None)
+    x_mcp_secret: Optional[str] = Header(default=None)
 ):
-    _auth_check(authorization)
+    _auth_check(x_mcp_secret)
     handler = TOOLS.get(req.tool)
     if not handler:
         raise HTTPException(status_code=404, detail=f"Unknown tool: {req.tool}")
@@ -54,8 +54,8 @@ async def call_tool(
 
 
 @app.get("/tools")
-async def list_tools(authorization: Optional[str] = Header(default=None)):
-    _auth_check(authorization)
+async def list_tools(x_mcp_secret: Optional[str] = Header(default=None)):
+    _auth_check(x_mcp_secret)
     return {"tools": list(TOOLS.keys())}