Authentication and tokens
Invites, quotas, rate limit headers, and how to check or rotate your token
Invites
The channel is open by invitation. Ajusteur issues a token per developer or assistant, with a daily number of tool calls and an optional expiry. Send it on every request:
Authorization: Bearer aj_…Without a live token the answer is 401 with WWW-Authenticate: Bearer realm="ajusteur".
Quotas and rate limit headers
Each invite has a daily quota of tool calls, counted per UTC day. Every answer from /api/mcp carries:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Tool calls allowed per day |
X-RateLimit-Remaining | Calls left today after this one |
X-RateLimit-Reset | Unix time when the day resets |
Past the quota the answer is 429 with Retry-After in seconds.
Your token
GET /api/mcp/me returns the invite behind your token: name, quota, calls today, what is left, when the day resets and the expiry. Nothing about anyone else.
POST /api/mcp/me with {"action":"rotate"} issues a new token for the same invite and retires the old one at once. The new token is returned once; update every client that used the old one.
Both are in the API reference: your invite and rotate your token, with a playground that sends your token as the bearer header. On the site, the reference page has a panel that checks, tries and rotates a token from the browser.
Errors
| Status | Meaning |
|---|---|
200 with isError: true | The tool refused its input. The reasons are in structuredContent.error.issues. |
401 | No live invite in the header. |
405 | Only POST. There are no sessions to open or close. |
429 | Daily quota used. |