🏗️ Architecture: Session 60.2: What is the authentication strategy for Cloud ...

Date: 2026-01-23
Time: 00:00:50 UTC
Session: editor2-60.5
Agent: backend
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

Session 60.2: What is the authentication strategy for Cloud MCP endpoints?

Task: Not specified

🎯 Decision Made

Chosen:

Hybrid auth - JWT for management, JWT+ApiKey for tools

Options Considered:

• No alternatives documented

💭 Reasoning

Project management (create/list/update/delete projects) requires JWT auth because users need to be logged in to manage their projects. Tool-calling endpoints (tools/call, preflight, usage) accept BOTH JWT and API Key because: (1) GoGrab Space users use JWT naturally, (2) External users (Claude Cowork, external apps) need API key access without logging in. The JwtOrApiKeyGuard checks for JWT first, then falls back to API key validation.

📁 Files Involved

• apis/backend-ai-api/src/app/mcp-gateway/mcp-gateway.controller.ts

🔗 Related

• Decision ID: dev_1769126446786_0c1hq3v
• Session: 60
• Workspace: editor2

Auto-generated by MCP Smart Consolidation