> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postqueen.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> PostQueen's hosted API is https://api.postqueen.ai. The public API base is https://api.postqueen.ai/public/v1 and takes the raw API key in the Authorization header, with no Bearer prefix.
> The MCP server for posting is https://api.postqueen.ai/mcp/YOUR_API_KEY (or /mcp with Authorization: Bearer YOUR_API_KEY). docs.postqueen.ai/mcp only searches these docs and cannot post.
> The API key is under Connections > API Keys in the app, and only workspace admins can see it.

# MCP on your server

> The MCP addresses of a self-hosted PostQueen, how to check them through your proxy, what the sign-in address needs, and the MCP settings you can change.

A self-hosted PostQueen serves MCP from its own backend, with no extra service to run. AI agents connect to it the same way they connect to PostQueen Cloud, with your own address in place of `api.postqueen.ai`.

## Your addresses

The backend's address is `NEXT_PUBLIC_BACKEND_URL`, which on a standard install is your domain plus `/api`:

| Address                                               | How it signs in                                                                         | Tools                       |
| ----------------------------------------------------- | --------------------------------------------------------------------------------------- | --------------------------- |
| `https://postqueen.example.com/api/mcp/YOUR_API_KEY`  | The API key is part of the address                                                      | 21                          |
| `https://postqueen.example.com/api/mcp`               | Header `Authorization: Bearer YOUR_API_KEY`                                             | 21                          |
| `https://api.postqueen.example.com/mcp-oauth-dynamic` | Sign in with PostQueen, on a backend host of its own: see [below](#the-sign-in-address) | 20, all but `ask_postqueen` |

**Connections** in your own install builds the key address from `NEXT_PUBLIC_BACKEND_URL` and shows it on every agent card with the key filled in. Each agent's page under [AI agents](/agents/overview) says where the address goes.

<Info>
  **Where the API key is:** in the app, open **Connections > API Keys**. Only a workspace Admin or Super Admin can reveal or rotate it; other members see it masked. A workspace has one key, and each agent card on **Connections** shows your MCP address with the key already filled in.
</Info>

Clients that only speak the older SSE transport can use `https://postqueen.example.com/api/sse/YOUR_API_KEY`. Prefer the addresses above: an SSE connection stays open, and proxies with short idle timeouts cut it.

## What the proxy needs

Nothing beyond what the web app needs. MCP requests are ordinary `POST` requests that go to the backend under `/api/`, and each answer is a single JSON response, not a stream, so buffering settings do not matter. Two things to keep:

* The proxy passes the `Authorization` header through, which every proxy on these pages does by default.
* The request body limit allows uploads: agents can attach media, and PostQueen accepts files up to 1 GB.

## Check it from outside

From your own computer, not the server:

```bash theme={"system"}
curl -i -X POST https://postqueen.example.com/api/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

| What comes back                             | What it means                                                                                                |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| A JSON list of tools                        | MCP works. Use the same address in the agent.                                                                |
| `401` with `Missing Authorization header`   | The header did not reach the backend.                                                                        |
| `401` with `Invalid API Key or OAuth token` | The key is wrong or was rotated.                                                                             |
| `400` with `Invalid API Key`                | On the key-in-the-address form: the key is wrong, or it is an OAuth token, which only the header form takes. |
| The web app's 404 page                      | The request went to the frontend. `NEXT_PUBLIC_BACKEND_URL` or the proxy's `/api/` route is wrong.           |

Errors come back as plain text, not JSON, so some agents show only a generic server error. Read the raw response before changing settings. Both addresses also answer a browser's `OPTIONS` preflight with `200` before any key is checked, so an agent that reports it connected has not yet proved the key works: the first tool call does.

## The sign-in address

Agents that sign in to MCP, instead of taking the key, use `/mcp-oauth-dynamic`. They register themselves, open PostQueen for a workspace Admin or Super Admin to approve, and the access lasts until it is revoked under **Connections > Approved Apps**. PostQueen has not tested this sign-in end to end yet.

Signing in needs discovery to work: the agent looks for the authorization server's metadata at the root of the backend's host. With the backend under `/api`, that lookup reaches the web app and fails. So:

<Steps>
  <Step title="Give the backend a host of its own">
    For example `api.postqueen.example.com`, routed to the backend at its root. [Split deployments](/reverse-proxies/split-deployments#give-the-backend-its-own-host) has the proxy configuration.
  </Step>

  <Step title="Advertise that host">
    ```env theme={"system"}
    NEXT_PUBLIC_OVERRIDE_BACKEND_URL=https://api.postqueen.example.com
    ```

    Recreate the container. The discovery documents then name that host.
  </Step>

  <Step title="Give agents the sign-in address on that host">
    `https://api.postqueen.example.com/mcp-oauth-dynamic`, with no slash at the end. An agent checks that the address it connected to matches the one the discovery names.
  </Step>
</Steps>

## Settings

MCP works with none of these set.

| Variable                           | What it changes                                                                                                                                                       |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NEXT_PUBLIC_OVERRIDE_BACKEND_URL` | The host that OAuth discovery advertises, as above. Falls back to `NEXT_PUBLIC_BACKEND_URL`.                                                                          |
| `DCR_VERIFIED_DOMAINS`             | Limits the `https` callback domains a self-registering agent may use. `localhost` and app schemes such as `cursor://` are not checked. Unset, any agent can register. |
| `OPENAI_OAUTH_CLIENT_ID`           | Turns on the `openid` and `email` scopes for a ChatGPT app you published, and for self-registered agents whose callbacks are all on a `DCR_VERIFIED_DOMAINS` domain.  |
| `OPENAI_APP_CHALLANGE`             | The domain verification string for publishing an OpenAI app, served at `/.well-known/openai-apps-challenge`.                                                          |
| `MCP_ONLY`                         | Serves only MCP and its sign-in routes. The web app and the public API stop working on that instance.                                                                 |
| `OPENAI_API_KEY`                   | Needed by the `ask_postqueen` tool, which hands a request to PostQueen's own agent.                                                                                   |

`MCP_URL` is passed to the web app but not used. [Configuration reference](/configuration/reference#mcp-and-oauth-apps) has every variable.

## Related

* [MCP server](/mcp/introduction)
* [Troubleshooting agents](/agents/troubleshooting)
* [Split deployments](/reverse-proxies/split-deployments)