refactor: simplify auth to only use Bearer token

- Remove X-Late-API-Key, X-API-Key, and query param support
- Use only standard 'Authorization: Bearer' header
- Simpler for users and more HTTP standard
- Better compatibility with OAuth-expecting tools
- Update all documentation and error messages

Author: carlosmgv02

docs/HTTP_DEPLOYMENT.md

@@ -27,7 +27,7 @@ curl http://localhost:8080/health
 curl http://localhost:8080/
 
 # SSE endpoint (requires your Late API key)
-curl -H "X-Late-API-Key: your_late_api_key" http://localhost:8080/sse
+curl -H "Authorization: Bearer your_late_api_key" http://localhost:8080/sse
 ```
 
 ## Railway Deployment
@@ -65,7 +65,7 @@ Configuration in MCP settings:
   "late": {
     "url": "https://your-app.railway.app/sse",
     "headers": {
-      "X-Late-API-Key": "your_late_api_key_here"
+      "Authorization": "Bearer your_late_api_key_here"
     }
   }
 }
@@ -76,9 +76,9 @@ Configuration in MCP settings:
 ```python
 from mcp.client.sse import sse_client
 
-# Provide your Late API key in headers
+# Provide your Late API key as Bearer token
 headers = {
-    "X-Late-API-Key": "your_late_api_key_here"
+    "Authorization": "Bearer your_late_api_key_here"
 }
 
 async with sse_client(
@@ -91,27 +91,17 @@ async with sse_client(
 
 ## Authentication
 
-Each user must provide their own Late API key when connecting. The server accepts API keys via:
+Each user must provide their own Late API key when connecting using the standard HTTP Authorization header:
 
-1. **X-Late-API-Key header** (recommended):
-   ```
-   X-Late-API-Key: your_late_api_key
-   ```
-
-2. **Authorization header** (Bearer token):
-   ```
-   Authorization: Bearer your_late_api_key
-   ```
-
-3. **X-API-Key header** (alternative):
-   ```
-   X-API-Key: your_late_api_key
-   ```
+```
+Authorization: Bearer YOUR_LATE_API_KEY
+```
 
-4. **Query parameter** (not recommended for production):
-   ```
-   https://your-app.railway.app/sse?api_key=your_late_api_key
-   ```
+Example:
+```bash
+curl -H "Authorization: Bearer sk_your_api_key_here" \
+     https://your-app.railway.app/sse
+```
 
 The server validates the API key by making a test request to the Late API. If valid, the connection is established and the API key is used for all subsequent operations.
 

src/late/mcp/auth.py

@@ -6,37 +6,20 @@
 
 def extract_late_api_key(request: Request) -> str | None:
     """
-    Extract Late API key from request.
+    Extract Late API key from request Authorization header.
 
-    Checks in order:
-    1. X-Late-API-Key header
-    2. Authorization header (Bearer token)
-    3. X-API-Key header
-    4. api_key query parameter
+    Expects: Authorization: Bearer <your_late_api_key>
 
     Args:
         request: The incoming Starlette request.
 
     Returns:
         The extracted API key, or None if not found.
     """
-    # Try X-Late-API-Key header first (most specific)
-    late_key = request.headers.get("X-Late-API-Key")
-    if late_key:
-        return late_key
-
-    # Try Authorization header: "Bearer <key>"
     auth_header = request.headers.get("Authorization")
     if auth_header and auth_header.startswith("Bearer "):
-        return auth_header[7:]
-
-    # Try X-API-Key header
-    api_key_header = request.headers.get("X-API-Key")
-    if api_key_header:
-        return api_key_header
-
-    # Try query parameter as fallback
-    return request.query_params.get("api_key")
+        return auth_header[7:]  # Remove "Bearer " prefix
+    return None
 
 
 async def verify_late_api_key(api_key: str) -> bool:

src/late/mcp/routes.py

@@ -31,7 +31,7 @@ async def handle_root(_request: Request) -> JSONResponse:
                 "health": f"{ENDPOINT_HEALTH} (GET) - Health check",
             },
             "documentation": DOCS_URL,
-            "authentication": "Required (use X-API-Key header or Bearer token)",
+            "authentication": "Required: 'Authorization: Bearer YOUR_LATE_API_KEY'",
         }
     )
 
@@ -67,7 +67,7 @@ async def handle_sse(request: Request) -> Response:
         late_api_key = extract_late_api_key(request)
         if not late_api_key:
             return JSONResponse(
-                {"error": "Missing Late API key. Provide via X-Late-API-Key header, Authorization: Bearer header, or X-API-Key header"},
+                {"error": "Missing Late API key. Provide via Authorization header: 'Authorization: Bearer YOUR_API_KEY'"},
                 status_code=401
             )