Authentication

Every MCP request to https://www.skavio.eu/processing/mcp must carry a bearer credential for exactly one verified Skavio company:

Authorization: Bearer skavio_mcp_<your-credential>

A static credential like this is the right choice for clients you configure and control yourself. Hosted remote clients that cannot hold a static secret — for example Smithery — should use the interactive OAuth 2.0 + PKCE sign-in described in OAuth instead. Both paths authenticate the same company-scoped principal against the same wallet and tools.

Your MCP credential is not your API key

The MCP credential is a dedicated, independently issued secret. It is not your Processing API key, and the two are never interchangeable:

• Your API key stays with you and is never sent to Skavio over MCP.
• Skavio holds the upstream Processing API key privately and never returns it.
• A credential is bound to one numeric company. The company is taken only from

the credential, never from a request argument. No tool accepts a company, role, credential, API base URL or endpoint as input.

Create a credential

1. Register or verify your company in the Skavio dashboard.
2. In the company security settings, create an MCP credential and choose its

role (a customer role is the normal choice for API/agent use).

1. Copy the credential once and store it in a secret manager. Skavio shows it

only at creation. Never paste it into chat, code, URLs or tickets.

Credential creation is an administrator action in the dashboard. It is not available through MCP itself.

Lifecycle: expiry, rotation, revocation

Every credential has an operator-set expiry and can be rotated or revoked at any time from the dashboard:

• Expiry — a credential stops authenticating automatically at its expiry

time. Rotate before expiry to avoid an outage.

• Rotation — issue a new credential, deploy it to your client, then revoke

the old one. Both the old credential's revocation and the new credential's activation are applied together when Skavio reloads the binding, so there is no window with no valid credential.

• Revocation — a revoked credential is rejected immediately. Revoking one

tenant's credential never affects any other tenant.

What the server checks on every request

• The credential must exist, be active, and belong to an active, unexpired,

unrevoked binding.

• The binding's rights block must allow the requested operation for that role.
• Company credit ceilings, per-job ceilings and request rate limits are enforced

in addition to your live wallet balance.

Errors

Never share a credential between companies or between people. If a credential may have leaked, revoke it and rotate immediately.