Authentication Strategy

Automatic OpenAPI signing

When MCP tools call /api/open/*, the server automatically injects:

• x-user-id
• x-timestamp
• x-sign

Signing rule:

signContent = userId + timestamp + bodyHash

Where:

• For GET and DELETE, bodyHash is an empty string
• For POST, PUT, and PATCH, bodyHash is the SHA256 hash of the JSON body

Session cookie forwarding

For admin and user APIs, the MCP server forwards MCP_SESSION_COOKIE to the upstream API as-is.