Authentication (API keys / tokens)

Each MelonHelp surface authenticates differently: MCP uses per-user OAuth, webhooks are verified with a shared secret, and the beta REST API uses workspace tokens.

MCP: per-user OAuth

When you connect Claude you authorize with your MelonHelp account (standard OAuth flow). The resulting token inherits your permissions: Claude sees what you can see, nothing more. You revoke it by disconnecting the connector.

Webhooks: signature with a secret

Each configured webhook has a secret. MelonHelp signs its deliveries so your endpoint can verify that the event is legitimate before processing it (details).

REST API (private beta): workspace token

The planned model:

• One token per workspace, generated from settings, sent as Authorization: Bearer <token>.
• Scope limited to the token's workspace — no cross-access.
• Rotation: generating a new one invalidates the previous one.

# Ejemplo del formato previsto
curl https://api.melonhelp.com/v1/tickets \
  -H "Authorization: Bearer mh_ws_..."

Best practices

• Never publish tokens in frontends or repos.
• One token per integrated system — so you can revoke without breaking everything else.
• ALWAYS verify the signature of incoming webhooks.