| Area | Current capability |
|---|---|
| API | Scoped keys, consistent envelopes, sessions/speakers/metadata endpoints, OpenAPI document, and developer page |
Live reference
Authentication and scopes
Send a Callboard API key on the MCP request as x-access-token. The MCP Worker
forwards that value as the same header on /v1 calls. It also accepts
Authorization: Bearer <key> as a convenience. Credentials are never accepted
in the URL and never appear in tool output.
Keys are event-scoped and scopes do not cascade. Mint one at /admin/api-keys
on the configured Callboard deployment. When an event-scoped tool omits
event_id, the server calls list_events once per MCP request and reuses the
result. That inference needs read:events; callers without it can pass
event_id explicitly.
| Tool | Required scope |
|---|---|
list_events |
read:events |
get_schedule |
read:sessions |
list_submissions |
read:sessions |
get_submission |
read:sessions |
search_speakers |
read:contacts |
list_tracks |
read:metadata |
capture_abstract |
write:sessions |
get_openapi |
None |