Skip to main content
ThornGuard exposes its MCP proxy and management API from https://thorns.qwady.app.

​
Hosts

  • https://thorns.qwady.app/mcp — public MCP proxy endpoint
  • https://thorns.qwady.app/api/* — management and telemetry API
  • https://thorns.qwady.io — live dashboard

​
Default Authentication

The default auth path remains:
  • License keys: THORN-...
  • Enterprise team tokens: THORN-TEAM-...
For MCP traffic, pass the credential in:
  • x-thornguard-license: Bearer THORN-...
For dashboard/API traffic, the current UI uses:
  • Authorization: Bearer THORN-...

​
OAuth / JWT Interoperability

ThornGuard also supports additive OAuth-style bearer authentication for HTTP clients when that deployment enables it. Protected Resource Metadata is served from:
  • /.well-known/oauth-protected-resource
  • /.well-known/oauth-protected-resource/mcp
License keys and team tokens remain the default documented path. OAuth/JWT is additive and deployment-configured.

​
Correlation Headers

ThornGuard returns these headers on successful proxied responses and ThornGuard-generated error responses:
  • x-thornguard-log-id
  • x-thornguard-trace-id
Use them to trace a client-visible request back to D1 audit logs and webhook deliveries.

​
Management API Surface

Core routes:
  • GET /api/logs
  • GET /api/logs/export
  • GET /api/stats
  • GET /api/settings
  • PUT /api/settings
  • GET /api/team
  • POST /api/team
  • PATCH /api/team/:id
  • DELETE /api/team/:id
Platform routes:
  • GET /api/policies
  • POST /api/policies
  • PATCH /api/policies/:id
  • DELETE /api/policies/:id
  • GET /api/integrations
  • POST /api/integrations
  • PATCH /api/integrations/:id
  • DELETE /api/integrations/:id
  • POST /api/integrations/:id/test
  • GET /api/integrations/:id/deliveries
  • GET /api/tools
  • GET /api/approval-profiles
  • POST /api/approval-profiles
  • PATCH /api/approval-profiles/:id
  • DELETE /api/approval-profiles/:id
  • GET /api/approval-requests
  • POST /api/approval-requests/:id/approve
  • POST /api/approval-requests/:id/deny
  • GET /api/redaction-rules
  • POST /api/redaction-rules
  • PATCH /api/redaction-rules/:id
  • DELETE /api/redaction-rules/:id

​
Upstream Credentials

If your upstream MCP server needs its own bearer token, pass it separately:
  • x-upstream-auth: Bearer ...
ThornGuard uses that value as the upstream Authorization header and does not forward your ThornGuard credential upstream.