Authenticated MCP welcome — mcpbotget

GET

/mcp-bot

const url = 'https://example.com/api/mcp-bot';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/mcp-bot \
  --header 'Authorization: Bearer <token>'

A verified bearer returns the welcome JSON (server name, version, and the canonical MCP endpoint). Every unauthenticated GET is 401 with WWW-Authenticate pointing at the canonical /.well-known/oauth-protected-resource/mcp metadata. A 200 welcome page is not that document. An authenticated GET with Accept: text/event-stream is 405; there is no standalone SSE stream.

Authorizations

mcpBearer

Responses

200

Authenticated welcome JSON

application/json

object

required

boolean

data

required

object

name

required

string

version

required

string

protocol

required

string

auth_required

required

boolean

tools_available_after_auth

boolean

discovery

required

object

next_step

required

string

endpoint

required

string format: uri

401

No usable bearer. WWW-Authenticate is a Bearer challenge whose resource_metadata parameter is the canonical protected-resource metadata URL ({API}/.well-known/oauth-protected-resource/mcp).

application/json

object

error

required

string

error_description

required

string

details

object

domain_code

string

Allowed values: AUTH_REQUIRED TOKEN_EXPIRED

Headers

WWW-Authenticate

required

string

Bearer challenge. resource_metadata points at /.well-known/oauth-protected-resource/mcp on the canonical API host (NEXT_PUBLIC_API_URL, default https://api.apphandoff.com).

405

Authenticated GET with Accept: text/event-stream. Stateless serving has no session to attach a stream to, so the SDK answers 405. An unauthenticated stream probe is 401, not 405.