List MCP tools
The exact tools/list an MCP client (Claude, Cursor, …) sees when it connects to POST /mcp with this key — the read surface always, plus each write action the key’s scopes authorise (applications:manage, webhooks:manage). Lets a UI or script verify the MCP surface without performing the JSON-RPC handshake. Requires scope: mcp:read.
Authorizations
A Custral secret API key (sk_…), created in Settings → Applications. Sent as Authorization: Bearer sk_…. The X-Api-Key: sk_… header is also accepted and takes precedence. Never expose a secret key in a browser.