Skip to main content
Casa Layer authenticates every request with a bearer token. Pick one method:

Personal API keys

First-party keys for scripts, CLIs, and MCP clients.

Partner API credentials

Client ID and secret for a third-party integration.

MCP server

Guest context for AI assistants over MCP.

​
Personal API keys

A personal API key is the first-party credential for your own systems. Create it in Account settings. The key starts with casa_. Use a personal API key for scripts, a CLI, and MCP clients such as Cursor. The same key works on the REST API and the MCP server. A key is scoped to your property group. You can pin it to one property at creation. A pinned key ignores X-Property-Id. Keys are read-only. They carry every public read scope except read:integrations. They cannot create or revoke other credentials. See Personal API keys for create, pin, and revoke steps.

​
Partner API credentials

A partner API credential is the credential for a third-party system that calls Casa Layer on your behalf. Create it under Integrations → Partner credentials. Casa Layer issues a client ID and client secret. The partner exchanges them for a short-lived access token, then calls REST. Scopes come from the credential you create. Partner tokens are REST-only and group-scoped. The MCP server rejects them. They accept X-Property-Id to drill one request down to a property in the group. Do not use this path for a human CLI. Partner credentials use a fixed read list. Casa Layer rejects writes, read:integrations, and *. See Partner API credentials for create, token, rotate, and revoke steps.

​
MCP server

The MCP server lets AI assistants read guest context with the same tenant isolation as REST. Two ways to authenticate:
  • Personal API key — Cursor, the MCP Inspector, and scripts send Authorization: Bearer casa_…. The key’s scopes apply.
  • Casa Layer sign-in — Claude adds the MCP URL as a custom connector. You sign in and consent. The connection is read-only, group-scoped, and MCP-only. Casa Layer rejects these tokens on every /v1/* REST route.
Partner access tokens cannot call MCP. Use a personal API key or Casa Layer sign-in. Casa Layer sign-in tokens carry a fixed read set, whatever the user’s role: read:guests, read:reservations, read:transactions, read:consents, read:events, read:reviews, read:loyalty, read:tables.

​
Tenant scope

The default scope is the property group. Requests return data across every property in the group. Two things narrow it:
  • X-Property-Id header — drills one request down to one property. The server verifies the property belongs to your group. Anything else is 403. Personal API keys and partner credentials accept this header. Casa Layer sign-in tokens reject it.
  • Property-pinned keys — a personal API key created with a property pin stays on that property. It ignores the drill-down header.
Tenant scope is resolved on the server from the credential. A request cannot widen it.

​
Scopes

Endpoints require a specific scope. A credential that holds * satisfies every scope. Only a signed-in session can hold * or the session-only scopes below. read:sql, read:integrations, write:integrations, write:tables, and * are session-only. A partner credential must pick at least one scope from the Yes column. Casa Layer rejects any other name. A valid token that misses the required scope returns 403:
No token, an unknown token, or a revoked credential returns 401:

​
Revocation timing

Personal API keys revoke immediately. The next request fails. A partner credential revoke is immediate on the Casa Layer credential. The next resolve returns 401. A leftover access token may still work until exp (up to 3600 seconds). Casa Layer does not keep a token denylist. Casa Layer sign-in credentials take effect within the access-token lifetime (≤ 1 hour). To lock out a first-party machine at once, revoke the personal API key. To lock out a partner, revoke the credentials.

​
Quick test

The same personal API key authenticates the MCP server.