MCP on your server

A self-hosted PostQueen serves MCP from its own backend, with no extra service to run. AI agents connect to it the same way they connect to PostQueen Cloud, with your own address in place of api.postqueen.ai.

Your addresses

The backend’s address is NEXT_PUBLIC_BACKEND_URL, which on a standard install is your domain plus /api:

Address	How it signs in	Tools
`https://postqueen.example.com/api/mcp/YOUR_API_KEY`	The API key is part of the address	21
`https://postqueen.example.com/api/mcp`	Header `Authorization: Bearer YOUR_API_KEY`	21
`https://api.postqueen.example.com/mcp-oauth-dynamic`	Sign in with PostQueen, on a backend host of its own: see below	20, all but `ask_postqueen`

Connections in your own install builds the key address from NEXT_PUBLIC_BACKEND_URL and shows it on every agent card with the key filled in. Each agent’s page under AI agents says where the address goes.

Where the API key is: in the app, open Connections > API Keys. Only a workspace Admin or Super Admin can reveal or rotate it; other members see it masked. A workspace has one key, and each agent card on Connections shows your MCP address with the key already filled in.

Clients that only speak the older SSE transport can use https://postqueen.example.com/api/sse/YOUR_API_KEY. Prefer the addresses above: an SSE connection stays open, and proxies with short idle timeouts cut it.

What the proxy needs

Nothing beyond what the web app needs. MCP requests are ordinary POST requests that go to the backend under /api/, and each answer is a single JSON response, not a stream, so buffering settings do not matter. Two things to keep:

The proxy passes the Authorization header through, which every proxy on these pages does by default.
The request body limit allows uploads: agents can attach media, and PostQueen accepts files up to 1 GB.

Check it from outside

From your own computer, not the server:

curl -i -X POST https://postqueen.example.com/api/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

What comes back	What it means
A JSON list of tools	MCP works. Use the same address in the agent.
`401` with `Missing Authorization header`	The header did not reach the backend.
`401` with `Invalid API Key or OAuth token`	The key is wrong or was rotated.
`400` with `Invalid API Key`	On the key-in-the-address form: the key is wrong, or it is an OAuth token, which only the header form takes.
The web app’s 404 page	The request went to the frontend. `NEXT_PUBLIC_BACKEND_URL` or the proxy’s `/api/` route is wrong.

Errors come back as plain text, not JSON, so some agents show only a generic server error. Read the raw response before changing settings. Both addresses also answer a browser’s OPTIONS preflight with 200 before any key is checked, so an agent that reports it connected has not yet proved the key works: the first tool call does. Agents that sign in to MCP, instead of taking the key, use /mcp-oauth-dynamic. They register themselves, open PostQueen for a workspace Admin or Super Admin to approve, and the access lasts until it is revoked under Connections > Approved Apps. PostQueen has not tested this sign-in end to end yet. Signing in needs discovery to work: the agent looks for the authorization server’s metadata at the root of the backend’s host. With the backend under /api, that lookup reaches the web app and fails. So:

Give the backend a host of its own

For example api.postqueen.example.com, routed to the backend at its root. Split deployments has the proxy configuration.

Advertise that host

NEXT_PUBLIC_OVERRIDE_BACKEND_URL=https://api.postqueen.example.com

Recreate the container. The discovery documents then name that host.

Give agents the sign-in address on that host

https://api.postqueen.example.com/mcp-oauth-dynamic, with no slash at the end. An agent checks that the address it connected to matches the one the discovery names.

Settings

MCP works with none of these set.

Variable	What it changes
`NEXT_PUBLIC_OVERRIDE_BACKEND_URL`	The host that OAuth discovery advertises, as above. Falls back to `NEXT_PUBLIC_BACKEND_URL`.
`DCR_VERIFIED_DOMAINS`	Limits the `https` callback domains a self-registering agent may use. `localhost` and app schemes such as `cursor://` are not checked. Unset, any agent can register.
`OPENAI_OAUTH_CLIENT_ID`	Turns on the `openid` and `email` scopes for a ChatGPT app you published, and for self-registered agents whose callbacks are all on a `DCR_VERIFIED_DOMAINS` domain.
`OPENAI_APP_CHALLANGE`	The domain verification string for publishing an OpenAI app, served at `/.well-known/openai-apps-challenge`.
`MCP_ONLY`	Serves only MCP and its sign-in routes. The web app and the public API stop working on that instance.
`OPENAI_API_KEY`	Needed by the `ask_postqueen` tool, which hands a request to PostQueen’s own agent.

MCP_URL is passed to the web app but not used. Configuration reference has every variable.

Start here

Install

Domain and HTTPS

Configure

Channel developer apps

Operate

Develop

Your addresses

What the proxy needs

Check it from outside

Settings

​Your addresses

​What the proxy needs

​Check it from outside

​The sign-in address

​Settings

​Related

Your addresses

What the proxy needs

Check it from outside

The sign-in address

Settings

Related