Developers
MCP Authentication
Workspace-scoped bearer tokens.
Every MCP request authenticates with a workspace-scoped Canu token sent as a bearer header. A token resolves to exactly one workspace, and every tool call is scoped to it — arguments cannot widen that scope.
text
Authorization: Bearer <CANU_MCP_TOKEN>Token rules
- Hashed at rest and shown exactly once at creation
- Scoped to a single workspace and its connections
- Read-only access level in V1
- Revocable at any time; revoked tokens fail immediately
- Every tool call is logged with client, operation, duration and status
Create, inspect and revoke your MCP tokens inside the workspace.
Open Workspace → MCP