> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alana.shopping/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Authentication

> Authenticate MCP connections with Bearer tokens and manage workspace scope.

## Authentication Method

Canal 3 uses **Bearer token authentication**. Pass your Alana API key as the Bearer token when configuring your MCP client.

```
Authorization: Bearer sk_live_your_api_key
```

## Required Scopes

| Tool Category                  | Required Scope           |
| ------------------------------ | ------------------------ |
| Catalog tools (search, browse) | `mcp:read`               |
| Optimization tools             | `mcp:read`               |
| Analytics tools                | `mcp:read`               |
| Feed tools (generate, manage)  | `mcp:read`, `feed:write` |

Create an API key with `mcp:read` scope to access all read-only tools. Add `feed:write` if your agent needs to trigger feed generation.

## Workspace Context

All MCP tool calls are scoped to the workspace associated with your API key. You cannot query products from a different workspace with the same key.

To work with multiple workspaces, create one API key per workspace.

## Creating API Keys

1. Open your workspace in Alana
2. Go to **Settings → API Keys**
3. Click **New API Key**
4. Enable `mcp:read` scope (and `feed:write` if needed)
5. Copy the key — it is shown only once

## Scope Matrix

| Tool                       | Required Scope | Description               |
| -------------------------- | -------------- | ------------------------- |
| `search_products`          | `mcp:read`     | Search catalog            |
| `get_product`              | `mcp:read`     | Fetch product details     |
| `list_catalogs`            | `mcp:read`     | List available catalogs   |
| `get_catalog_stats`        | `mcp:read`     | Catalog statistics        |
| `optimize_product`         | `mcp:read`     | Optimize product content  |
| `batch_optimize`           | `mcp:read`     | Batch optimization        |
| `get_score`                | `mcp:read`     | Get optimization score    |
| `compare_scores`           | `mcp:read`     | Compare scores            |
| `get_search_analytics`     | `mcp:read`     | Search analytics          |
| `get_query_performance`    | `mcp:read`     | Query performance         |
| `get_recommendation_stats` | `mcp:read`     | Recommendation stats      |
| `generate_description`     | `mcp:read`     | AI description generation |
| `enhance_images`           | `mcp:read`     | Image enhancement         |
| `get_brand_context`        | `mcp:read`     | Brand context retrieval   |

## Token Security

* Never embed API keys directly in client-side code
* Rotate keys regularly from **Settings → API Keys**
* Use the minimum required scope for each integration
* Revoke compromised keys immediately from the dashboard