Authentication

Bearer authentication

Send the API key in the Authorization header. Keys are scoped and managed in the console; do not commit, log, or return them to a browser.

Authorization: Bearer ${MC1_API_KEY}

Agent identity context

Consequential tool calls can require a signed Cairo Agent identity with organization, principal, trust, permissions, issuance, and expiry claims. Public self-service identity issuance is not documented as a current API; obtain the supported issuer workflow through your ColomboAI deployment contact.

Key hygiene

• Use separate keys per environment and workload.
• Rotate on a schedule and immediately after suspected exposure.
• Grant the minimum project scope.
• Redact Authorization headers from logs and traces.