Upstream auth & base URL

Agents talk to MakeCallable. MakeCallable talks to your API.

Base URL

Set the project base URL to the host agents should hit — usually your production or staging API origin (scheme + host, no trailing path clutter).

Examples:

• https://api.acmejobs.example
• https://staging.api.yourproduct.com

We reject private networks, localhost, and cloud metadata endpoints (SSRF guard).

Upstream secret

If your API requires auth, store the secret on the project:

• Bearer token
• API key header value
• whatever your OpenAPI securitySchemes expect us to forward

Proxied tool calls use the upstream credential. The MCP client’s Bearer apiKey only authenticates to MakeCallable.

Mental model

Agent  --Bearer mcpApiKey-->  MakeCallable  --upstream secret-->  Your API

Rotate the MCP API key anytime from the project page without rotating your product credentials.

Checklist

1. Base URL resolves publicly
2. Upstream secret matches what the API expects
3. OpenAPI security schemes align with that secret
4. A manual curl to the same base URL works with the same credential

If calls 401/403 upstream, fix the secret or scheme mapping — not the MCP install URL.

---

Next: Install clients