N3
API key bound to identity
Unit E1 · Verification type Test
- Every MCP request is assigned to an Identity via the API key; the permissions correspond exactly to those of the Identity, restricted by scopes.
- A test verifies that an API key cannot perform an operation that is denied to the Identity via the UI, and vice versa.