Authentication

REST API keys

Create keys in Settings → Developers. Each key:

• Belongs to one organisation
• Inherits the creating user's role
• Is further limited by the abilities you tick
• Is sent as Authorization: Bearer dop_…

curl -H "Authorization: Bearer dop_…" \
  -H "Accept: application/json" \
  https://your-org.doorops.com/api/v1/ping

There are no deletes on the public API. Rotate a key by creating a new one and revoking the old.

API access requires the separately scoped api_access add-on entitlement; a higher usage tier alone does not grant API keys.

MCP OAuth

Tenant MCP uses OAuth 2.1 (Passport). The only MCP scope is mcp:use. The agent signs in as a Door Ops user and keeps that user's role. Revoke under Settings → Connected apps.

Do not put API keys into an MCP client. Use OAuth.

Third-party OAuth apps

Register at /developer/apps. Allowed scopes are the REST family (customers:read, jobs:write, …). mcp:use is not offered there.