# MCP HTTP Endpoints Reference

> Markdown variant of <https://www.skillzdrive.com/docs/reference/endpoints>.

HTTP endpoints for connecting to the SkillzDrive MCP server.

## MCP endpoint

All MCP communication goes through a single endpoint using
Streamable HTTP transport:

```
https://www.skillzdrive.com/api/mcp
```

| Method | Purpose |
|--------|---------|
| `POST` | Send JSON-RPC messages (tool calls, initialize, etc.) |
| `GET` | Open SSE stream for server notifications |
| `DELETE` | Terminate session |

Most MCP client libraries handle the HTTP methods automatically.
You just configure the URL and auth header — the SDK does the
rest.

## Authentication

Include your API key in the `Authorization` header on every
request:

| Header | Value |
|--------|-------|
| `Authorization` | `Bearer sk_live_YOUR_KEY` |
| `Content-Type` | `application/json` |

## OAuth endpoints

For clients that use OAuth 2.0 instead of API keys (e.g. Claude
Code, Claude.ai):

| Method | Path | Purpose |
|--------|------|---------|
| `POST` | `/api/mcp/oauth/token` | Exchange authorization code or client credentials for a token |
| `POST` | `/api/mcp/oauth/register` | Dynamic client registration (RFC 7591) |
| `GET` | `/.well-known/oauth-authorization-server` | OAuth discovery metadata (RFC 8414) |

Most developers use API keys (simpler). OAuth is handled
automatically by MCP clients that support it — you don't need to
call these endpoints manually. See the
[Authentication guide](https://www.skillzdrive.com/docs/guides/authentication.md)
for details.

## Legacy SSE transport

For older MCP clients using the separated SSE pattern:

| Method | Path | Purpose |
|--------|------|---------|
| `GET` | `/api/mcp/sse` | Open SSE channel; response includes the message endpoint URL |
| `POST` | `/message?sessionId=…` | Send JSON-RPC messages bound to the SSE channel |

Streamable HTTP is preferred. Use legacy SSE only when your client
doesn't support the newer transport.

## CORS

The MCP server sets these CORS headers:

```http
Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization, Accept, MCP-Session-Id, MCP-Protocol-Version
Access-Control-Expose-Headers: MCP-Session-Id
```

## Next steps

- [MCP tools reference](https://www.skillzdrive.com/docs/reference/tools.md).
- [Authentication](https://www.skillzdrive.com/docs/guides/authentication.md): API keys, OAuth 2.0, securing your integration.
- [Connecting](https://www.skillzdrive.com/docs/guides/connecting.md): client config recipes.