MailKatana uses workspace-scoped Bearer API keys for both documented developer surfaces.

​
REST API

Send your API key in the Authorization header:

​
MCP server

MCP authentication happens at the HTTP transport layer, not through tool arguments.
  • Streamable HTTP server URL: https://api.mailkatana.com/mcp
  • Legacy SSE endpoint: https://api.mailkatana.com/mcp/sse
  • Header: Authorization: Bearer YOUR_API_KEY
These are protected MCP endpoints. Streamable HTTP clients must include the header on every request. If you request either URL without it, expect a 401 rather than an HTML page. If your MCP client still asks for an _apiKey tool argument, do not use that pattern here. MailKatana expects the Bearer token in the HTTP Authorization header.

​
Shared behavior

  • One API key maps tool calls or REST requests to a single workspace.
  • Missing or invalid credentials return 401.
  • REST and MCP both sit behind the same per-IP developer rate limit.