Authentication

All requests authenticate via a Bearer token in the Authorization header.

Authorization: Bearer liza_mcp_…

Which data and tools are visible depends on your role (owner > admin > user > follower > guest) and your connected integrations (for example, CRM tools only appear when a CRM integration is connected).

TIP

You create the token in the Liza settings. Treat it like a password — it carries your permissions.

Auth cache

Tokens are cached briefly on the server side. Deleting, deactivating or reissuing a token in the settings clears that cache automatically, so a revoked token stops working immediately rather than when the cache expires.

If a token was changed directly in the database, you can clear the entry manually. The endpoint is authenticated and only clears the cache entry of the token you send:

curl -X POST https://api.eu.liza.app/api/mcp/clear-cache \
  -H "Authorization: Bearer YOUR_TOKEN"