Authentication & Scopes
API keys
The MCP server authenticates with the same Public API keys used by the REST API. Send the key as a bearer token on every request:
Authorization: Bearer dlr_live_xxxxxxxxxxxxxxxx| Key prefix | Endpoint |
|---|---|
dlr_live_… | https://api.dialora.ai/mcp |
The server validates the key on every request — revoked, disabled, or expired keys are rejected with 401 unauthorized.
Scopes
Each tool maps to a scope. The server only exposes the tools your key is entitled to — a tool whose scope (or key tier) your key lacks is not registered, so it never appears in the assistant’s tool list. Grant only what the assistant needs.
| Scope | Grants | Tools |
|---|---|---|
calls:read | Read calls & transcripts | list_calls, get_call |
calls:write | Place / manage calls | create_call |
users:read | List end users | list_users |
users:write | Create / delete end users | create_user, delete_user |
plans:read | List plans | list_plans, get_plan |
subscriptions:read | Read subscriptions | list_subscriptions, get_subscription |
subscriptions:write | Create / change subscriptions | create_subscription, update_subscription_plan |
Account keys vs. tenant (agency) keys. Keys created by a regular user from Settings → API Keys can only grant calls:read and calls:write. The users, plans, and subscriptions scopes are reserved for tenant-level keys issued from the agency dashboard.
Tenant isolation
A key is bound to one Dialora tenant (and, for account keys, one account). Tools only ever see and act on data belonging to that tenant — there is no way for a key to reach another customer’s data.