Describe the bug
list_sites (the MCP tool backing GET /organizations) returns 401 Unauthorized when called with an Organization API key, even with full access. Other MCP tools work fine with the same key.
To Reproduce
- Create an Organization API key (Settings > Organization > API Keys), no restrictions
- Connect an MCP client using the key as
Authorization: Bearer <key>
- Call
get_site(site_id) or get_overview(site_id), it works
- Call
list_sites, get 401 Unauthorized
Expected behavior
list_sites should work for a full-access Organization API key the same way it does for a Personal API key. Org keys are the documented recommendation for integrations.
Additional context
Self-hosted v2.8.0.
getMyOrganizations (backing GET /organizations) authenticates through getUserIdFromRequest, which only returns a value when the credential has a userId. Organization owned keys have organizationId instead of userId (see BearerAuthResult). So getUserIdFromRequest always returns null for an org key and the route 401s no matter what permissions the key has.
Describe the bug
list_sites(the MCP tool backingGET /organizations) returns 401 Unauthorized when called with an Organization API key, even with full access. Other MCP tools work fine with the same key.To Reproduce
Authorization: Bearer <key>get_site(site_id)orget_overview(site_id), it workslist_sites, get 401 UnauthorizedExpected behavior
list_sitesshould work for a full-access Organization API key the same way it does for a Personal API key. Org keys are the documented recommendation for integrations.Additional context
Self-hosted v2.8.0.
getMyOrganizations(backingGET /organizations) authenticates throughgetUserIdFromRequest, which only returns a value when the credential has auserId. Organization owned keys haveorganizationIdinstead ofuserId(seeBearerAuthResult). SogetUserIdFromRequestalways returns null for an org key and the route 401s no matter what permissions the key has.