Start
Authentication
One bearer token, sent on every call that draws an answer. There is nothing else to sign.
The header
Authorization: Bearer pc_live_…
Keep it on your own server. A key in a browser is a key anyone can read, and a key is the whole of the identity here — there is no second factor behind it because there is no account behind it either.
Where a key comes from
Your account. Signing in with Google or Microsoft is only how the address is verified; that address is the whole of what is kept beside the key. No password reaches us and none is stored.
A key can be revoked from the same page, and a revoked key stops working at once — on HTTP and on MCP alike, since both read the same list.
What a refusal says
401 — no key, or one that is not ours. The body names the header to send and where a key comes from, rather than only saying no.
403 — a real key asking for something that is not its own. Only the website's key may ask what an address has spent.
429 — a real key over its allowance or its rate. Which of the two, and what had been spent, is in the body; Retry-After is beside it when waiting is the answer. See limits and errors.
For agents
An unauthenticated call to /mcp/ answers 401 with WWW-Authenticate naming the protected-resource metadata at priorcase.com/.well-known/oauth-protected-resource/mcp, as RFC 9728 asks. A client that reads it finds where to send a token without being told by hand.
Anything a form cannot settle — a plan larger than the ones listed, showing our answers to someone who is not you — is read by a person at api@priorcase.com.