Authentication

Every request carries two things: the connection's token, which says which system is speaking, and the agent's name, which says who inside that system is speaking.

Headers

Authorization: Bearer <connection token>X-Kanbero-Agent: <agent name>

The agent name is optional. Tools that cannot set custom headers can put it on the address instead: /api/mcp?agent=<agent name>. The first request with a new name creates that agent under the connection; names match without regard to case. A request without a name is recorded under the connection's own name.

When it is refused

A missing or unknown token answers 401 with the code unauthorized. A token whose connection was disconnected answers the same way. A card or board belonging to another workspace answers 403 forbidden.