Authentication

Igdrasil HTTP APIs use bearer-token authentication.

Authorization: Bearer <token>

Company-scoped endpoints also require:

X-Company-Id: <company-id>

Bearer tokens

Use a current token issued for the user or integration context making the request. Expired, malformed, missing, or unauthorized tokens return an authentication error.

Company scope

Send X-Company-Id for endpoints that read or change company data. The API checks that the authenticated principal is allowed to access that company before returning data or applying changes.

MCP authentication

Hosted MCP clients use the MCP-specific OAuth flow described in MCP API. Do not substitute ordinary product API tokens for MCP resource tokens unless Igdrasil has explicitly configured that client path.

Credential handling

Store tokens outside source code, rotate credentials when access changes, and avoid sharing credentials between environments.